- An error named Whoami was found in Amazon Machine Image
- It allows threat players to get RCE -skills on people’s AWS accounts
- A solution has been released but many users have not yet updated
Amazon Web Services (AWS) users are potentially vulnerable to a naming confusion attack called “Whoami,” experts have warned.
The vulnerability found in the Amazon Machine Image (AMI) was discovered in the summer of 2024 by cybersecurity scientists data trains, and has now been confirmed by Amazon who said it solved the problem on its side and urged users to update the code on their side and thus protect their premises.
Ami is a pre-configured template used to create and start virtual servers (EC2 deposits) in AWS. It includes an operating system, application software and necessary configurations such as storage and permits. AMIS allows users to quickly implement consistent environments, whether to use AWS-delivered images, Society AMIS or custom-built. This makes scaling and control of sky infrastructure more efficient.
After the naming pattern
AMIS can be public or private, and once generated, comes with a unique identifier. Public can even be found in the AWS catalog. But these public should also come up with the attribute ‘owners’ as a way of confirming that they are coming from a trusted source.
Now, the researchers found that the way software projecters picked up AMI IDs were deficient, and allowed threat actors to get Remote Code Execution (RCE) capabilities within People’s AWS accounts.
The technical details of how the vulnerability works and how it can be exploited can be found at this link. Long story short, if a threat actor publishes an AMI with a name that follows the format used by trusted owners, it can be picked up by mistake.
When Datadog first discovered the error, it said a very small percentage of AWS users are generally vulnerable, but it still corresponds to “thousands” of AWS accounts. Amazon responded by issuing a solution in mid -September last year and releasing a new security check called “allowed AMIS” at the beginning of December last year.
It also advised all users to use the corrections while stressing that there was no evidence of abuse in nature.
Via Bleeping computer
