AWS has corrected a flaw in its Elastic Container Registry (ECR) that Lightspin researcher Gafnit Amiga discovered while investigating the ECR APIs of AWS.
By leveraging undocumented internal ECR Public API methods, the vulnerability “enabled external actors to delete, alter, and create ECR Public images, layers, and tags in registries and repositories that belong to other AWS Accounts.”
Such projects would be vulnerable to malware infiltration, and ECR would portray them as trustworthy, opening the door to software supply chain attacks.
The Public Gallery of Elastic Container Registry is home to well-known projects including NGINX, Ubuntu Linux, Amazon Linux, and Consul from HashiCorp.
Amiga figured out how to misuse the APIs from seven publicly available but undocumented API actions.
An enemy might, according to her, “do what I did and either remove or push new pictures which would seem as verified Registries belonging to Amazon, Canonical, and other well-known corporations, and providers.”
The size of the risk, according to her, is difficult to gauge: “There are many more photographs saved on ECR Public, and just the top six most downloaded images from the ECR Public Gallery have a combined total of about 13 billion downloads.
According to a study of Lightspin’s clients, 26% of all Kubernetes clusters contain at least one Pod that downloads an image from public.ecr.aws.
In November, the vulnerability was patched.
“We have undertaken comprehensive investigation of all logs, and we are convinced our review was conclusive. The sole activity related with this issue was between accounts controlled by the researcher,” AWS stated in its advisory.
No consumer action is necessary, and no other customers’ accounts were impacted.