Cloud vulnerability analysis 7

What this is

Lab notes from CloudGoat’s RCE Web App scenario (medium size, hard difficulty). The exercise starts from ordinary IAM users and asks you to find a secret stored in RDS inside a multi-service VPC (ELB, EC2, S3, RDS).

Vulnerability class (concept)

• Remote code execution on a public-facing app sitting behind a load balancer, so a foothold on the instance becomes a foothold in the VPC.
• Over-privileged instance profiles / IAM paths that turn a web compromise into broader AWS access.
• Secrets and keys left in reachable places (user data, object storage, database contents) rather than in a managed secrets store with tight IAM.

Impact (abstract)

If a reachable web app can run attacker-controlled commands, and the host or role can reach IMDS, databases, or object storage, the blast radius can grow from “one app” to “credentials and data across the account.” In this lab theme, that includes paths toward RDS secrets and alternate IAM personas.

Lessons / what to check

• Prefer IMDSv2 and restrict instance metadata; do not put long-lived credentials in user data.
• Treat ELB/access logs and “secret” URL paths as sensitive reconnaissance surfaces; don’t rely on obscurity.
• Keep SSH keys, DB passwords, and admin material out of S3 unless encrypted and tightly scoped.
• Apply least privilege on instance profiles; separate app runtime from database-admin and key-management roles.
• Patch or remove command-execution features in internal “admin” or “ticket” style web UIs.

Solve steps and PoC omitted.