Re:Investigating Privilege Escalation Methods in AWS
by kevinStorj on Saturday December 21, 2019 @11:36PM
(#21855207)
The Privilege Escalation attack vector can be avoided by using a capability-based security model, ala: https://storj.io/blog/2019/12/secure-access-control-in-the-d...
[ Parent
| on HN ]
Re:Investigating Privilege Escalation Methods in AWS
by donavanm on Sunday December 22, 2019 @08:20PM
(#21860828)
How is this relevant? AFAICT AWS Policy statements are capabilities. Each policy statement denotes both actions and resources, and that policy is then granted to another identity/resource.
As noted by other comments the parent article focuses on capabilities that grant definition of capabilities. It shouldn't be surprising that principals can use that to establish further capabilities in the absence of other restrictions.