Summary
If the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider.
This is a follow up of a vulnerability that @JLLeitschuh also reported back in 2017: dan200/ComputerCraft#170
Details
The default set of patterns that are forbidden by CC-Tweaked are defined by this predicate:
|
final class PrivatePattern implements AddressPredicate { |
|
static final PrivatePattern INSTANCE = new PrivatePattern(); |
|
|
|
@Override |
|
public boolean matches(InetAddress socketAddress) { |
|
return socketAddress.isAnyLocalAddress() |
|
|| socketAddress.isLoopbackAddress() |
|
|| socketAddress.isLinkLocalAddress() |
|
|| socketAddress.isSiteLocalAddress(); |
|
} |
|
} |
This, by default, this does include the IP or Domains that most IMDS use:
- IPv4:
169.254.169.254
metadata.google.internal (in the case of GCP)
However, this, by default, does not include the IPs used by other popular IMDS:
- Oracle Cloud:
192.0.0.192
- Alibaba Cloud:
100.100.100.200
- AWS:
fd00:ec2::254
PoC
http.get("http://100.100.100.200/[cloud host specific path]"):readAll()
Impact
This can allow a player on a server, using a cc-tweaked computer to retrieve sensitive information like:
- User-data passed to the system at boot time (could contain secrets)
- IAM role credentials (could allow access to the greater AWS cloud account)
- Managed identity credentials (could allow access to the Azure account)
- Service account tokens (allowing access to the GCP account)
References
Related
JLLeitschuh Reporter
Summary
If the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider.
This is a follow up of a vulnerability that @JLLeitschuh also reported back in 2017: dan200/ComputerCraft#170
Details
The default set of patterns that are forbidden by CC-Tweaked are defined by this predicate:
CC-Tweaked/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java
Lines 116 to 126 in 96847bb
This, by default, this does include the IP or Domains that most IMDS use:
169.254.169.254metadata.google.internal(in the case of GCP)However, this, by default, does not include the IPs used by other popular IMDS:
192.0.0.192100.100.100.200fd00:ec2::254PoC
Impact
This can allow a player on a server, using a cc-tweaked computer to retrieve sensitive information like:
References
Related