Hacking Serverless Applications: A Treasure Map for Uncharted Waters

Hacking Serverless Applications: A Treasure Map for Uncharted Waters

Speakers: Matteo Rosi

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=bXvrKY6XNAQ

Overview

Matteo Rosi's talk, "Hacking Serverless Applications: A Treasure Map for Uncharted Waters," delivered at BSides NYC, explores the evolving landscape of application security in the era of serverless computing. As organizations increasingly migrate from monolithic and microservices architectures to highly distributed, event-driven serverless models, new security paradigms and vulnerabilities emerge. Rosi provides a comprehensive look into these uncharted waters, highlighting the unique challenges and attack vectors inherent in serverless environments.

The presentation emphasizes that while serverless abstracts away much of the underlying infrastructure management, it introduces a distinct set of security responsibilities for developers and security professionals. Rosi delves into common misconfigurations, supply chain vulnerabilities within third-party libraries, and the critical importance of robust logging and monitoring in these ephemeral execution environments. Through live demonstrations, he illustrates how attackers can exploit vulnerabilities in serverless functions, exfiltrate sensitive data, and even leverage compromised credentials to extend their reach within cloud environments.

This talk is crucial for anyone involved in developing, deploying, or securing serverless applications. It serves as a practical guide for understanding the new attack surfaces, identifying common pitfalls, and implementing effective defensive strategies. Rosi's insights underscore the need for a "SecOps" mindset, where security considerations are deeply embedded throughout the entire application lifecycle, from development to deployment and beyond, to safeguard against the sophisticated threats targeting modern serverless architectures.

Background

▶ Watch: Serverless Security: The New Challenge (4:00)

The evolution of application architectures has shifted significantly, from traditional monolithic applications to microservices, and now increasingly towards serverless computing. This progression, driven by scalability, reduced operational overhead, and faster development, fundamentally alters application building and deployment. In serverless models like AWS Lambda, applications comprise small, stateless functions triggered by events (e.g., HTTP requests, file uploads). Cloud providers dynamically manage infrastructure, scaling functions and billing only for compute time. This necessitates a "SecOps" approach, integrating security throughout the development and deployment pipeline.

This architectural shift introduces unique security challenges. Traditional perimeter-based security is less relevant; focus shifts to Identity and Access Management (IAM), secure coding, and robust monitoring. Rosi highlights the shared responsibility model: cloud providers secure the cloud of (infrastructure), while customers secure in the cloud (code, configurations, data, access controls). Misconfigurations, especially in IAM, are common. The ephemeral, event-driven nature of serverless makes traditional security assessments difficult to scale, and growing adoption expands the attack surface.

Key Findings

▶ Watch: Legacy vs. Serverless Security Paradigms (10:00)

Matteo Rosi's presentation uncovers several critical security findings and common vulnerabilities prevalent in serverless applications, offering a "treasure map" to potential attack vectors. These findings highlight that while serverless abstracts infrastructure, it does not abstract security risks, often shifting them to different layers of the application stack.

One primary finding revolves around insufficient logging and monitoring. Rosi explains that default logging provided by cloud services, such as AWS CloudWatch logs for Lambda functions, often lack the necessary context and detail to detect sophisticated attacks or quickly diagnose security incidents. Attackers exploit this blind spot, making it challenging for defenders to identify malicious activity. The talk emphasizes that many vulnerabilities reside not within the cloud provider's infrastructure but within the application code itself or the third-party libraries it utilizes, underscoring the need for comprehensive application-level logging and proactive monitoring.

Another significant area of concern is over-privileged IAM roles and misconfigurations. Rosi demonstrates a scenario where a Lambda function is granted excessive permissions, such as the ability to read all tables in a DynamoDB instance, when it only requires access to a specific table. This violation of the principle of least privilege creates a wide attack surface, allowing an attacker who compromises the function to gain unauthorized access to sensitive data or perform actions beyond the function's intended scope. Manual assessment of these permissions is often insufficient due to the complex, event-driven nature of serverless architectures.

The talk also identifies supply chain vulnerabilities as a major threat. Rosi references well-known examples like Log4Shell and Spring4Shell to illustrate how vulnerabilities in widely used libraries can propagate into serverless functions. Because these functions often run code from various open-source or third-party dependencies, a single flaw in a library can expose numerous applications. The speaker demonstrates exploiting such a vulnerability (Spring Expression Language) directly within a Lambda function, showcasing how these flaws can be leveraged for remote code execution even before the main application logic is processed.

Finally, Rosi touches upon the risk of Denial of Wallet attacks. While serverless mitigates traditional denial-of-service (DoS) by scaling automatically, malicious actors can exploit this elasticity to incur significant costs for the victim. By triggering an excessive number of function invocations or API calls, an attacker can rapidly deplete a cloud budget, effectively denying service by making it financially unsustainable. This highlights a unique economic attack vector in serverless environments that defenders must consider.

Technical Deep Dive

▶ Watch: Common Serverless Attack Vectors Explained (18:00)

The technical depth of serverless security lies in understanding the ephemeral nature of its components, the event-driven interaction model, and the critical role of Identity and Access Management (IAM). Rosi's technical deep dive illustrates how these characteristics create novel attack surfaces.

At the core of serverless computing are functions-as-a-service (FaaS) like AWS Lambda. When an event triggers a Lambda, the cloud provider spins up an ephemeral container to execute the code. While typically discarded, containers can be reused for performance (mitigating cold starts). Rosi highlights the risk: sensitive data saved in the container's temporary file system (/tmp) or memory can be exposed if the container is reused. This presents a unique data hygiene challenge, making /tmp a common target for attackers to drop tools or exfiltrate data.

The interaction between serverless components is predominantly event-driven. Services communicate via asynchronous events through message queues (e.g., AWS SQS), notification services (e.g., AWS SNS), or object storage (e.g., AWS S3). This distributed, loosely coupled architecture makes tracing attack paths and understanding blast radius difficult with traditional network security tools. Attackers can leverage this event-driven model to chain attacks across multiple services.

IAM roles and policies are fundamental security controls. Each Lambda assumes an IAM role defining its permissions to interact with other AWS services. Rosi demonstrates that an overly permissive IAM policy – e.g., dynamodb:ReadItem on * (all tables) instead of a specific table – is a critical misconfiguration. An attacker achieving remote code execution (RCE) on such a function inherits these broad permissions, gaining access to any authorized resource. Inside the Lambda environment, temporary AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) are available; their exfiltration grants an attacker programmatic access with the compromised function's permissions.

Furthermore, Rosi highlights vulnerabilities from third-party libraries and frameworks. He recreated a scenario involving the Spring Expression Language (SpEL) vulnerability (similar to Spring4Shell CVE-2022-22965) within a Lambda. This allows arbitrary code execution by injecting malicious expressions into input fields, even before primary application logic. This demonstrates a significant supply chain risk where vulnerable dependencies introduce exploitable flaws, emphasizing paramount vulnerability scanning.

The speaker also alludes to different attack vectors beyond traditional web requests, such as voice-based attacks targeting Alexa skills. This concept underscores the expanding attack surface to include novel interfaces that process user input, which can be manipulated to trigger malicious code.

Demo / Proof of Concept

▶ Watch: Live Demo: Spring Expression Language (SpEL) RCE (22:00)

Matteo Rosi's presentation included several compelling live demonstrations that vividly illustrated the vulnerabilities and attack techniques discussed. These proofs of concept served as a practical "treasure map" for how attackers navigate and exploit serverless environments.

The first major demonstration focused on exploiting a Spring Expression Language (SpEL) vulnerability within an AWS Lambda function. Rosi recreated a Lambda using the Spring framework, making it susceptible to SpEL injection, akin to the infamous Spring4Shell vulnerability. The attack involved sending a crafted HTTP request to an API Gateway endpoint, which triggered the vulnerable Lambda. The payload, embedded in a JSON header, was designed to execute remote commands.

Upon execution, Rosi showed the injected ls command successfully listing the Lambda's execution environment. More critically, the env command revealed sensitive environment variables, including temporary AWS credentials: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. Exfiltrating these grants an attacker programmatic access to the AWS account with the compromised function's IAM role. He also showed the /var/task directory containing the deployed Lambda code. This demo powerfully illustrated how a common library vulnerability could lead to full compromise of a serverless function's execution context.

The second demonstration centered on a file upload vulnerability in an event-driven serverless application. Uploading a file to an S3 bucket would trigger a Lambda to process it. Rosi first showed a "good" upload, then a "bad" file containing a malicious payload designed to exfiltrate data from /tmp or the Lambda's source code (/var/task). The attacker's server displayed the exfiltrated content, demonstrating successful data exfiltration. Rosi further showed how exfiltrated temporary AWS credentials could be used to compromise the AWS account, allowing an attacker to use AWS CLI commands to query or manipulate other AWS resources, showcasing lateral movement.

Finally, Rosi briefly alluded to a third proof of concept involving voice-based attacks on an Alexa skill. While not fully detailed in the transcript, he mentioned that his manager had presented this at DEF CON, highlighting the potential to exploit Lambda code behind an Alexa skill through voice commands. This served to broaden the audience's understanding of diverse attack vectors beyond traditional HTTP requests, emphasizing that any input source for a serverless function can be a potential attack surface.

Defensive Implications

▶ Watch: Future Serverless Attack Vectors: Email & Alexa (44:00)

The vulnerabilities and attack techniques demonstrated by Matteo Rosi carry significant defensive implications for organizations leveraging serverless architectures. Protecting these dynamic, event-driven environments requires a multi-faceted approach that integrates security throughout the entire development and operational lifecycle.

Firstly, implementing the principle of least privilege is paramount. Overly broad IAM permissions, as demonstrated with DynamoDB, are critical misconfigurations. Defenders must meticulously restrict IAM policies, ensuring each function has only the absolute minimum permissions. Tools like IAM access analyzer and automated policy validation should integrate into CI/CD pipelines, complemented by regular audits of IAM roles.

Secondly, robust logging and monitoring are non-negotiable. Default cloud logs are often inadequate. Defenders must augment platform-level logging with detailed application-level logging, capturing critical events and parameters. These logs should be centralized, correlated, and analyzed by Security Information and Event Management (SIEM) systems or cloud-native security services (e.g., AWS Security Hub, GuardDuty) for anomaly detection. Real-time alerts for suspicious activities, such as unusual API calls or unexpected network connections, are vital for rapid incident response.

Thirdly, secure coding practices and supply chain security must be rigorously enforced. The Spring Expression Language vulnerability highlights the risk of vulnerable third-party libraries. Defenders should implement Software Composition Analysis (SCA) tools to identify and remediate known vulnerabilities in dependencies. Automated security testing (SAST, DAST) should integrate into the development pipeline. Developers need education on serverless-specific secure coding, including input validation, output encoding, and avoiding sensitive data storage in temporary directories or environment variables.

Fourthly, organizations must consider runtime protection and configuration hardening. Despite OS abstraction, runtime environment vulnerabilities persist. Defenders should leverage cloud provider security features, like Lambda Layers for centralized dependency management. Regular security assessments and penetration testing targeting serverless functions are crucial. Additionally, securing the /tmp directory by ensuring data does not persist across invocations is important.

Finally, addressing Denial of Wallet attacks requires proactive cost monitoring and control mechanisms. Defenders should set up budget alerts within their cloud accounts and implement throttles or rate limits on API Gateway endpoints that trigger serverless functions. Designing functions to be idempotent and resilient to repeated invocations can also mitigate the impact of such attacks. Understanding the economic implications of serverless attacks adds a new dimension to incident response planning.

Key Takeaways

• Serverless Shifts Security Responsibility: While cloud providers secure the infrastructure, customers are fully responsible for the security of their code, configurations, and data within serverless applications.
• Least Privilege is Critical: Over-privileged IAM roles are a pervasive and dangerous misconfiguration, allowing attackers to escalate privileges and access unauthorized resources upon function compromise.
• Supply Chain Vulnerabilities are Potent: Flaws in third-party libraries and frameworks (like Spring4Shell) can lead to remote code execution in serverless functions, emphasizing the need for robust software composition analysis.
• Logging and Monitoring Must Be Enhanced: Default cloud logs are often insufficient; detailed application-level logging and proactive monitoring are essential for detecting and responding to serverless-specific threats.
• Ephemeral Environments Hide Sensitive Data: The /tmp directory and environment variables can expose temporary credentials and sensitive data if not properly managed, especially with container reuse.
• New Attack Vectors Emerge: Beyond traditional web requests, event-driven and novel interfaces (like voice commands for Alexa skills) introduce new attack surfaces that require specialized security considerations.

About the Speaker(s)

Matteo Rosi is a security expert who specializes in the evolving landscape of application security, particularly within serverless architectures. His presentation at BSides NYC demonstrates a deep understanding of the unique challenges and vulnerabilities that arise as organizations transition to highly distributed, event-driven computing models. Rosi's work focuses on identifying new attack vectors, analyzing the implications of shared responsibility in the cloud, and advocating for robust security practices from development through deployment. While specific titles or company affiliations were not detailed in the provided transcript or metadata, his expertise is clearly rooted in practical offensive security research and a commitment to educating the community on how to navigate the complex security terrain of serverless applications.