Researchers uncovered a critical vulnerability in Amazon Web Services (AWS)<\/a> involving Amazon Machine Images (AMIs).\u00a0<\/p>\n Dubbed the \u201cwhoAMI\u201d attack, this exploit leverages a name confusion attack, a subset of supply chain attacks, to gain unauthorized code execution within AWS accounts.\u00a0<\/p>\n The vulnerability arises from misconfigured software that retrieves AMIs without properly specifying trusted owners, potentially exposing thousands of AWS accounts to exploitation.<\/p>\n The \u201cwhoAMI\u201d attack exploits a common pattern in retrieving AMI IDs via the ec2:DescribeImages API.\u00a0<\/p>\n This API allows users to filter images based on attributes like name but can inadvertently include malicious AMIs if the owner\u2019s parameter is not explicitly defined.\u00a0<\/p>\n For example, the following Terraform code snippet illustrates a vulnerable configuration:<\/p>\n When executed, this code retrieves the most recently published AMI matching the filter criteria, regardless of its source, and reads the Datadog security labs report<\/a>.\u00a0<\/p>\n An attacker can exploit this by publishing a malicious AMI with a crafted name (e.g., ubuntu\/images\/hvm-ssd\/ubuntu-focal-20.04-amd64-server-whoAMI) that appears more recent than legitimate images.<\/p>\n If deployed at scale, this attack could compromise thousands of AWS accounts<\/a>. Datadog estimates that approximately 1% of organizations using AWS are vulnerable.<\/p>\n Unexpectedly, internal non-production systems within AWS were also found susceptible to this attack during Datadog\u2019s research.\u00a0<\/p>\n This vulnerability could have enabled attackers to execute arbitrary code within AWS\u2019s internal systems if exploited.<\/p>\n
![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcEF8G_XLY8GpV_FWDHJe7ADkVKVzx8oeHzKHQ_3kY6LZsSlBDRtmY4d5kHpZTXv5DrOgrPXpE-7MtKShBkoh_ycRbwpAtutGuVEicNpwG72JdPIEZj14r1mrmoeYKOHQnQVc7N?key=MBZjuayS75bUzFSyint87SBH\")
![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXex89TdXO8IjC9WnjEAiUGaficyumRI6DcoswFAAD43AyWXBT2CpuyTxXW8GzGsVJJfOG5DnBkeHAo3yES0LJm3E54YIMat4ig8yQFypxwlCqqFDU4UbAPpqUABUrBCp1uUzcHzaQ?key=MBZjuayS75bUzFSyint87SBH\")