Exploit AWS Lambda Function

What is AWS Lambda

AWS Lambda is a serverless compute service that allows to run the code without provisioning or managing servers.

While performing an API pentesting, I found that one of the endpoint having parameter, URL, which is vulnerable to Local File Inclusion vulnerability.

Local File Inclusion

Local File Inclusion (LFI) is a type of vulnerability that allows an attacker to include and execute arbitrary files on the server. Exploiting this vulnerability involves the attacker supplying a malicious file path as a parameter value, potentially pointing to a local file on the server. This exploit enables the attacker to access sensitive data, like configuration files or user credentials, execute arbitrary code, and potentially seize full control of the server.

Once I found that endpoint is vulnerable to LFI, I tried to read sensitive file from the server such as /etc/passwd file. I was successfully able to read it.

As I know that endpoint is using Lambda function, I tired to access environment variable to see if any AWS credentials are presented. After successfully execution, I saw that AWS Access key and token are presented.

Exported the AWS secret key and session token in the AWS CLI.

Once the keys are exported, I run below command to check the details of IAM user or which user these keys are belongs to.

aws sts get-caller-identity 

Above command is successfully executed and I got the user details, account number and ARN details.

After this, I run the command to check attached policies.

Extract the policy details.

his is how I successfully exploited AWS Lambda function.