HOW ATTACKERS ABUSE SERVERLESS SERVICES TO HARVEST SENSITIVE DATA FROM ENVIRONMENT VARIABLES

Summary from the TLDR InfoSec newsletter

This post provides an overview of how attackers exploit environment variables from serverless devices post-exploitation. When secrets are stored directly in environment variables, they can be leaked by an attacker that can achieve code execution on the function. As permissions are generally provided to the serverless execution environment via environment variables, they can also be acquired by the attacker to pivot to other services in the account that the function can access. To mitigate these issues, utilize Secrets Manager services, audit functions, scope roles to least privilege, and alert on abuse.