BUCKET MONOPOLY: BREACHING AWS ACCOUNTS THROUGH SHADOW RESOURCES

Summary from the TLDR InfoSec newsletter

Researchers have discovered a novel attack technique in AWS whereby an attacker can create S3 buckets that utilize the naming system of AWS services to in some cases even achieve RCE. When certain features in Cloudformation, Glue, EMR, Sagemaker, ServiceCatalog, or Codestar are first used, AWS creates an S3 bucket with a scheme such as cf-templates-- (for Cloudformation templates). If an attacker were to create a bucket with a guessed hash that matches the one that AWS would create for an account, the attacker would control the bucket and its contents. AWS has fixed the vulnerabilities in all services other than Codestar, which is not accepting new customers.