Last Thursday, at RSA Conference in San Francisco, the researchers from Wiz.io unveiled an open-source cloud middleware database on GitHub that details the particular middleware agents that Amazon Web Services (AWS), Google, and Microsoft put on their cloud customers’ virtual machines. The aim is to expose this often hidden proprietary software layer with known security flaws that might not otherwise be discovered or patched.
Cloud providers frequently install “secret agent” middleware programs on their customers’ virtual machines, with the most power, as a “bridge” between their cloud services and VMs.The Cloud Middleware Dataset database project aims to give cloud consumers insight into this layer of software that they are rarely aware exists on their virtual machines in a cloud service, as well as the security risks it presents.
These agents offer an additional attack surface, and customers are unaware of them; the majority are put in with no one’s knowledge.
Last fall, the most high-profile example of a cloud middleware failure was Microsoft Azure’s Open Management Infrastructure (OMI) agent software. Tamari and his team discovered major remote execution and privilege escalation flaws in Azure, dubbed OMIGOD, which included a number of flaws. OMI is a configuration management tool that runs on many Linux VMs in Azure to provide cloud customers with configuration management capabilities.
The most severe of the four OMIGOD flaws (CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649) was CVE-2021-38647. This vulnerability allowed a hacker to obtain full root access to a VM with a single packet. A problem occurred when a default OMI configuration was exposed on the public Internet via the HTTPS management port. After initially releasing fixes that affected most Azure customers, Microsoft provided auto-updates for Azure to address the flaws.
In the case of the OMIGOD flaws, Microsoft released a patch for Azure customers, but it was not clear if this was because OMI is proprietary to Azure or because the flaw was particularly severe.
Wiz.io’s researchers are now crowdsourcing information about cloud middleware in an attempt to build up a more comprehensive picture of what is out there.
The GitHub repository includes a list of middleware software agents from AWS, Google, and Microsoft, as well as links to information about each one.
The team is also inviting others to contribute to the project.
While the focus is currently on AWS, Google, and Microsoft, the researchers say that they hope to expand the project to cover other cloud providers in the future.
The Cloud Middleware Dataset aims to provide visibility into the middleware layer, which is often hidden from view, and to help identify security risks that might otherwise go unnoticed. By crowdsourcing information about cloud middleware, the team hopes to build up a more comprehensive picture of what is out there and to help keep people informed about the risks that these agents pose.
The Cloud Middleware Dataset thus far includes several agents from Azure, such as the Microsoft Azure Guest Agent (WALinuxAgent), which is pre-configured in all Azure Linux images and has root access. The agent is currently listed by the WALinuxAgent in the database, with an information disclosure vulnerability, CVE-2019-0804. It might allow an attacker to gain access to kernel memory from a user process if exploited.
Operations Management Suite, dependency agent, pipelines agent, and RD Agent service are some of the database-layer Azure middleware that has been discussed previously.
The AWS Systems Manager Agent, Amazon PV Drivers, the AWS ECS container agent, and the AWS EC2 Hibernation Initialization Agent are all considered middleware agents by Red Hat. This year, a local privilege escalation vulnerability CVE-2022-29527 was discovered in SSM Agent that an attacker might exploit to gain root access.
Conclusion
While the cloud middleware dataset is still in its early stages, it provides a valuable resource for those looking to learn more about these agents’ risks. By crowdsourcing information about cloud middleware, specialists hope to build a more comprehensive picture of what is out there and help keep people informed about the risks these agents pose.