EC2 Metadata Insecure

The EC2 Metadata Service (IMDS) lacks authentication, posing a risk of unauthorised access to sensitive services. Adversaries could extract valuable information, such as service tokens, from this endpoint, potentially gaining unauthorised access to other AWS services.

Remediation

Enable token requirement for IMDS. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options

Metadata

Severity: high
Slug: ec2-metadata-insecure

CWEs

284: Improper Access Control

OWASP

A05:2021: Security Misconfiguration

Available Labs

Open Aws labs in SecDim Play for this vulnerability.

easy

EC2.aws

Other Easy AWS Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.