When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM 0-Day Vulnerability
summary
A SugarCRM RCE (CVE-2023-22952) leads to EC2 compromise where attackers harvest long‑term AWS keys from ~/.aws/credentials (AKIA prefix), run pacu and ScoutSuite and call GetCallerIdentity plus Organizations and CostAndUsage APIs to find master account email and spend patterns. They create RDS snapshots, flip snapshots to public, change security groups to add MySQL, build AMIs, import key pairs and spin EC2 in other regions. Cloud phase spans 2–4 days (21–27 total). Fix: rotate/delete keys, avoid host creds, enforce granular IAM, enable CloudTrail/GuardDuty/VPC flow logs and MFA on root.
AI-written summary · about
chapters (7)
- 0:00Introduction and scope
- 2:01Initial compromise and discovery
- 10:54Lateral movement and exfiltration
- 15:54Evasion and persistence techniques
- 16:34Incident analysis summary
- 20:14Remediation and best practices
- 23:48Conclusion
related talks
16mLessons from the SOC: Analyzing and remediating cloud attack paths
36mCloud Hacking Scenarios
50mInsights into New Supply Chain and Cloud-Identity Attacks
44mCloud Metadata Abuse
56mPivoting in Amazon Clouds
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
46mAttacking AWS: The Full Cyber Kill Chain