From 0885fad685a914dda5f2b24dbe7c2b03745c669c Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Fri, 23 Oct 2026 06:23:49 +0200 Subject: [PATCH] Record historical AWS exclusion sources and clarify bounded routes --- ...ed_app_plane_subject_strict_reaudit_20261016.yaml | 1 + ...uded_bounded_service_role_overclaim_20261016.yaml | 1 + ..._consumer_input_join_strict_reaudit_20261016.yaml | 1 + ...d_consumer_semantics_strict_reaudit_20261016.yaml | 1 + .../aws/_excluded_eks_strict_reaudit_20261016.yaml | 1 + ...d_execution_foothold_strict_reaudit_20261016.yaml | 1 + .../aws/_excluded_generated_scope_20261016.yaml | 12 ++++++++---- ...ed_generic_challenge_strict_reaudit_20261016.yaml | 1 + .../aws/_excluded_org_scope_overclaim_20261016.yaml | 1 + .../_excluded_scoped_role_overclaim_20261016.yaml | 2 ++ ...ncollected_host_join_strict_reaudit_20261016.yaml | 11 ++++++++--- 11 files changed, 26 insertions(+), 7 deletions(-) diff --git a/src/privilege-escalation-paths/aws/_excluded_app_plane_subject_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_app_plane_subject_strict_reaudit_20261016.yaml index 889afa5fd7..7bb32cfb26 100644 --- a/src/privilege-escalation-paths/aws/_excluded_app_plane_subject_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_app_plane_subject_strict_reaudit_20261016.yaml @@ -6,6 +6,7 @@ it controls and can sign into is joined to that change. prior_id: aws-connect-security-profile-admin - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-grafana-privesc/README.md#grafanaupdatepermissions--iam-identity-center-administrator + historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-managed-grafana-persistence/README.md#grafanaupdatepermissions--iam-identity-center-administrator source_revision: b587e6bd26 technique: Grant a controlled Identity Center identity Grafana administrator access reason: UpdatePermissions can grant ADMIN to an Identity Center identity, but the diff --git a/src/privilege-escalation-paths/aws/_excluded_bounded_service_role_overclaim_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_bounded_service_role_overclaim_20261016.yaml index 84099257d8..c190e1f817 100644 --- a/src/privilege-escalation-paths/aws/_excluded_bounded_service_role_overclaim_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_bounded_service_role_overclaim_20261016.yaml @@ -36,6 +36,7 @@ reason: Attaching a role to a Redshift warehouse yields only SQL integration operations, not the full IAM role session or permissions. - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md#s3createjob-s3-batch-operations-iampassrole--mass-copyexposelock-a-whole-bucket-as-a-passed-role + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md#s3createjob-s3-batch-operations-iampassrole--mass-copyexposelock-a-whole-bucket-as-a-passed-role technique: aws-s3-batchoperations-passrole-createjob reason: S3 Batch Operations executes a bounded S3/Lambda job. The source does not gain general access to the passed role. diff --git a/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml index a7b6450c28..f20743f3b2 100644 --- a/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_consumer_input_join_strict_reaudit_20261016.yaml @@ -24,6 +24,7 @@ gain.' prior_id: aws-appstream-updateapplication-elastic-fleet - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md#sagemaker-model-registry-supply-chain-injection-via-createmodelpackageapproved + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md#sagemaker-model-registry-supply-chain-injection-via-createmodelpackageapproved source_revision: b587e6bd26 technique: Register an Approved model version in a Model Package Group consumed by auto-deploy automation diff --git a/src/privilege-escalation-paths/aws/_excluded_consumer_semantics_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_consumer_semantics_strict_reaudit_20261016.yaml index 11824f3d4a..511a61c649 100644 --- a/src/privilege-escalation-paths/aws/_excluded_consumer_semantics_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_consumer_semantics_strict_reaudit_20261016.yaml @@ -20,6 +20,7 @@ poisoning only. prior_id: aws-codebuild-env-secretsmanager-poisoning - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md#replace-the-root-volume-of-an-existing-role-bearing-ec2-instance + historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md#ec2 source_revision: b587e6bd26 technique: Replace the root volume of an existing role-bearing EC2 instance reason: CreateReplaceRootVolumeTask does not prove the source controls a compatible replacement diff --git a/src/privilege-escalation-paths/aws/_excluded_eks_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_eks_strict_reaudit_20261016.yaml index 6fd716bb17..dbd132b2d7 100644 --- a/src/privilege-escalation-paths/aws/_excluded_eks_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_eks_strict_reaudit_20261016.yaml @@ -36,6 +36,7 @@ only a condition. prior_id: aws-eks-passrole-createnodegroup - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-eks-privesc/README.md#eksassociateidentityproviderconfig-with-a-matching-privileged-rbac-group + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md#eksassociateidentityproviderconfig-with-a-matching-privileged-rbac-group source_revision: b587e6bd26 technique: Associate an attacker-controlled OIDC identity provider with an EKS cluster that binds a privileged RBAC group diff --git a/src/privilege-escalation-paths/aws/_excluded_execution_foothold_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_execution_foothold_strict_reaudit_20261016.yaml index 59aacea0c5..03f248f8a3 100644 --- a/src/privilege-escalation-paths/aws/_excluded_execution_foothold_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_execution_foothold_strict_reaudit_20261016.yaml @@ -13,6 +13,7 @@ placement and host access are only prose conditions. prior_id: aws-ecs-registercontainerinstance-scheduled-tasks - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md#steer-replacement-service-tasks-to-an-attacker-controlled-container-instance + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md#steer-replacement-service-tasks-to-an-attacker-controlled-container-instance source_revision: b587e6bd26 technique: Drain or deregister legitimate container instances so service tasks are replaced onto a controlled instance diff --git a/src/privilege-escalation-paths/aws/_excluded_generated_scope_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_generated_scope_20261016.yaml index 66975cd5d8..b0e1953034 100644 --- a/src/privilege-escalation-paths/aws/_excluded_generated_scope_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_generated_scope_20261016.yaml @@ -84,12 +84,14 @@ chain. Reauthor the exact source action, resource, credential subject and effective added permissions before restoring.' - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow source_revision: 0d0ea06005 technique: aws-audit-trigger-stored-query-that-delivers-restricted-secrets - reason: 'Trigger stored query that delivers restricted secrets: no source IAM action or resource is declared in - requires. The conditional aws_role target relies on opaque evidence, so the YAML cannot prove Alice''s permission-to-action-to-subject - chain. Reauthor the exact source action, resource, credential subject and effective added permissions before - restoring.' + reason: ExecuteScheduledQuery runs only the stored SQL of an exact existing scheduled query with its + stored role and destinations. The caller may choose InvocationTime but cannot replace the SQL, + role, target or notification in that call. The operation returns no role credentials or new IAM + permission. A principal edge would need a separately proven downstream credential or permission + effect under source control, which is not collected. - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-appsync-post-exploitation/README.md#read-environment-secrets-and-export-the-schema technique: aws-audit2-appsync-2 reason: 'Read environment secrets and export the schema: no source IAM action or resource is declared in requires. @@ -480,6 +482,7 @@ alone proves only an application session or incomplete AWS credential. Require actual unredacted secret material, validity and principal attribution before an IAM edge.' - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role source_revision: 0d0ea06005 technique: aws-audit-create-scheduled-query-to-exfiltrate-role-readable-secrets reason: 'Create scheduled query to exfiltrate role-readable secrets: the modeled target is terminal aws_verified_authority/bounded_authority, @@ -841,6 +844,7 @@ for WorkSpaces Secure Browser access, but the portal login is not an IAM role session. The page does not identify an exact AWS principal gained by the source.' - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-sitewise-privesc/README.md#grant-yourself-access-to-a-legacy-sitewise-monitor-portal + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iot-sitewise-post-exploitation/README.md#grant-yourself-access-to-a-legacy-sitewise-monitor-portal technique: aws-v3-19-grant-a-controlled-identity-sitewise-monitor-administra reason: Only the exact self-admin grant on one existing portal with reviewed before/after access is active as aws-sitewise-createaccesspolicy-portal-self-grant. The legacy controlled-other-identity target lacks a typed source-control join and remains excluded. source_revision: d11f0e7012 diff --git a/src/privilege-escalation-paths/aws/_excluded_generic_challenge_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_generic_challenge_strict_reaudit_20261016.yaml index 1dd7d17ba1..cf21cb6c55 100644 --- a/src/privilege-escalation-paths/aws/_excluded_generic_challenge_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_generic_challenge_strict_reaudit_20261016.yaml @@ -1,5 +1,6 @@ # Exact originals: docs/privesc-ledgers/aws-scope-archive-20261016/generic-challenge-strict-re-audit.yaml.txt. - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md#change-cdktoolkit-trustedaccounts-to-attacker-account-and-deploy-role-trust + historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md#cdk-bootstrap-stack source_revision: b587e6bd26 technique: Change CDKToolkit TrustedAccounts to attacker account and deploy role trust reason: CloudFormation stack update can alter a bootstrap trust list, but the source is not diff --git a/src/privilege-escalation-paths/aws/_excluded_org_scope_overclaim_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_org_scope_overclaim_20261016.yaml index 7a06ee4178..eafc1df8ba 100644 --- a/src/privilege-escalation-paths/aws/_excluded_org_scope_overclaim_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_org_scope_overclaim_20261016.yaml @@ -5,6 +5,7 @@ lacks exact evidence that the target account has no MFA barrier or a usable recovery path, so root/account-admin access is not established. - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md#organizationsregisterdelegatedadministrator--delegate-a-service-to-a-member-account + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md#organizationsregisterdelegatedadministrator--hand-a-services-org-wide-control-to-an-account-you-own technique: aws-organizations-registerdelegatedadministrator reason: RegisterDelegatedAdministrator alone grants only service-specific delegation to a separate controlled member-account identity. The catalog does not bind that identity, service-specific administrative actions, or diff --git a/src/privilege-escalation-paths/aws/_excluded_scoped_role_overclaim_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_scoped_role_overclaim_20261016.yaml index 39fee8ef8c..856157f281 100644 --- a/src/privilege-escalation-paths/aws/_excluded_scoped_role_overclaim_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_scoped_role_overclaim_20261016.yaml @@ -44,10 +44,12 @@ bucket, prefix or object. The separate aws-s3-accessgrants-self-grant route models a verified new READ permission on that bounded scope without claiming the location role's other permissions. - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-snowball-post-exploitation/README.md#snowballcreatejob--iampassrole--create-a-physical-s3-export-through-a-privileged-role + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-snowball-privesc/README.md#snowballcreatejob--iampassrole--create-a-physical-s3-export-through-a-privileged-role technique: aws-snowball-passrole-createjob reason: The passed role is used only for a physical S3 export job; the source receives data, not the role identity or IAM permissions. - source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-snowball-post-exploitation/README.md#snowballupdatejob--make-an-existing-snow-role-export-additional-s3-data-to-another-address + historical_source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-snowball-privesc/README.md#snowballupdatejob--make-an-existing-snow-role-export-additional-s3-data-to-another-address technique: aws-snowball-updatejob-existing-role reason: Retargeting a physical export job discloses selected S3 data but does not yield the stored role identity or IAM permissions. diff --git a/src/privilege-escalation-paths/aws/_excluded_uncollected_host_join_strict_reaudit_20261016.yaml b/src/privilege-escalation-paths/aws/_excluded_uncollected_host_join_strict_reaudit_20261016.yaml index 079633c439..0714e4cabd 100644 --- a/src/privilege-escalation-paths/aws/_excluded_uncollected_host_join_strict_reaudit_20261016.yaml +++ b/src/privilege-escalation-paths/aws/_excluded_uncollected_host_join_strict_reaudit_20261016.yaml @@ -77,6 +77,7 @@ source operation reaches. prior_id: aws-gamelift-getcomputeaccess-fleet-instance-role - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mainframe-modernization-privesc/README.md#m2updateapplication---store-a-malicious-application-version-for-later-deployment + historical_source: src/pentesting-cloud/aws-security/aws-persistence/aws-mainframe-modernization-persistence/README.md#m2updateapplication---store-a-malicious-application-version-for-later-deployment source_revision: b587e6bd26 technique: Deploy a modified M2 application version under its existing role reason: 'UpdateApplication creates a stored application version without changing its roleArn @@ -89,12 +90,16 @@ a reachable role.' prior_id: aws-m2-updateapplication-deploy-existing-role - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-agentcore-privesc/README.md#aws---agentcore-harness-rce-via-indirect-prompt-injection + historical_source: src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md#aws---agentcore-harness-rce-via-indirect-prompt-injection source_revision: b587e6bd26 technique: Invoke an existing AgentCore harness with its shell tool to run commands as its execution role - reason: The bedrock-agentcore_harness resource-to-role attachment is not loaded by the AWS evaluator - (absent from HOST_KIND); service trust or a guessed resource cannot identify the exact role - that the source operation reaches. + reason: InvokeHarness may pass attacker-controlled content to a harness with shell available, but the + API does not dispatch a caller-supplied toolUse block. The model must choose the shell tool. A + principal edge needs the exact reachable harness, effective invocation permission, controlled + input actually consumed, shell allowed for that invocation, useful command execution under its + role, and a resulting role-authorized action or credential. Those runtime facts are not + collected. prior_id: aws-bedrock-agentcore-invokeharness-shell-existing - source: src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md#lambdacreatemicrovmshellauthtoken--shell-into-an-existing-lambda-microvm source_revision: 171e422299