AWS Elastic Beanstalk CNAME Records Vulnerable To Takeover

More Info:

AWS Elastic Beanstalk CNAME Records Vulnerable To Takeover

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using the AWS console, follow these steps:

1. Sign in to the AWS Management Console.
2. Go to the Route53 service.
3. In the Route53 dashboard, select the hosted zone where the Elastic Beanstalk CNAME record is present.
4. Locate the CNAME record associated with your Elastic Beanstalk environment.
5. Click on the CNAME record to select it.
6. Choose the “Actions” dropdown menu and click on “Delete record set” to remove the vulnerable CNAME record.
7. Confirm the deletion by clicking on “Yes, Delete”.
8. Once the CNAME record is deleted, you need to create an Alias record to point to the Elastic Beanstalk environment.
9. Click on the “Create record set” button.
10. In the “Name” field, enter the subdomain or hostname you want to associate with the Elastic Beanstalk environment.
11. Set the “Type” field to “A - IPv4 address”.
12. Check the “Alias” checkbox.
13. In the “Alias target” field, select your Elastic Beanstalk environment from the dropdown list.
14. Click on the “Create” button to create the Alias record.
15. Verify that the new Alias record is created and points to the correct Elastic Beanstalk environment.

By following these steps, you have successfully remediated the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using the AWS console.

Using CLI

To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using AWS CLI, follow these steps:

1. Open the AWS Command Line Interface (CLI) on your local machine.

2. Ensure that you have the AWS CLI installed and configured with the necessary credentials to access your AWS account.

3. Identify the misconfigured CNAME record associated with your Elastic Beanstalk environment. You can do this by listing the hosted zones in Route53 and locating the relevant Elastic Beanstalk environment.

   Run the following command to list all the hosted zones in Route53:

   aws route53 list-hosted-zones
   

   Identify the hosted zone corresponding to your Elastic Beanstalk environment.

4. Once you have identified the hosted zone, you need to update the CNAME record to make it more secure. You can achieve this by following these sub-steps:

   a. Get the current record set for the CNAME record using the list-resource-record-sets command. Replace HOSTED_ZONE_ID with the ID of your hosted zone and CNAME_RECORD_NAME with the name of your CNAME record.

   aws route53 list-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --query "ResourceRecordSets[?Name == 'CNAME_RECORD_NAME']"
   

   b. Make a note of the TTL, Name, Type, and ResourceRecords values from the command output.

   c. Delete the existing CNAME record using the change-resource-record-sets command. Replace HOSTED_ZONE_ID with the ID of your hosted zone and CNAME_RECORD_NAME with the name of your CNAME record.

   aws route53 change-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --change-batch '{"Changes":[{"Action":"DELETE","ResourceRecordSet":{"Name":"CNAME_RECORD_NAME","Type":"CNAME","TTL":TTL,"ResourceRecords": [{"Value": "EXISTING_VALUE"}]}}]}'
   

   Replace EXISTING_VALUE with the existing value of the CNAME record.

   d. Create a new CNAME record using the change-resource-record-sets command. Replace HOSTED_ZONE_ID with the ID of your hosted zone, CNAME_RECORD_NAME with the name of your CNAME record, NEW_VALUE with the desired value of the CNAME record, and TTL with the desired TTL value.

   aws route53 change-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --change-batch '{"Changes":[{"Action":"CREATE","ResourceRecordSet":{"Name":"CNAME_RECORD_NAME","Type":"CNAME","TTL":TTL,"ResourceRecords": [{"Value": "NEW_VALUE"}]}}]}'
   

   Replace NEW_VALUE with the new desired value for the CNAME record.

5. Verify that the CNAME record has been updated successfully by running the list-resource-record-sets command again and ensuring that the new record is present.

   aws route53 list-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --query "ResourceRecordSets[?Name == 'CNAME_RECORD_NAME']"
   

By following these steps, you should be able to remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using AWS CLI.

Using Python

To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records, you can follow the steps below using Python:

1. Install the required Python packages:

   pip install boto3
   

2. Import the necessary modules in your Python script:

   import boto3
   

3. Create a function to retrieve the CNAME records for your Elastic Beanstalk environment:

   def get_eb_cname_records(environment_name):
       client = boto3.client('elasticbeanstalk')
       response = client.describe_environments(EnvironmentNames=[environment_name])
       cname_records = response['Environments'][0]['CNAME']
       return cname_records
   

4. Create a function to delete the CNAME records from AWS Route 53:

   def delete_route53_cname_records(cname_records, hosted_zone_id):
       client = boto3.client('route53')
       changes = []
       for cname in cname_records:
           change = {
               'Action': 'DELETE',
               'ResourceRecordSet': {
                   'Name': cname,
                   'Type': 'CNAME',
                   'TTL': 300,
                   'ResourceRecords': [{'Value': cname}]
               }
           }
           changes.append(change)
       response = client.change_resource_record_sets(
           HostedZoneId=hosted_zone_id,
           ChangeBatch={
               'Changes': changes
           }
       )
       return response
   

5. Call the functions and pass the required parameters to delete the CNAME records:

   environment_name = 'your_environment_name'
   hosted_zone_id = 'your_hosted_zone_id'
   
   cname_records = get_eb_cname_records(environment_name)
   response = delete_route53_cname_records(cname_records, hosted_zone_id)
   print(response)
   

Note: Make sure you have the necessary permissions to access Elastic Beanstalk and Route 53 services. Also, replace ‘your_environment_name’ and ‘your_hosted_zone_id’ with the appropriate values specific to your environment and hosted zone.

These steps will help you remediate the vulnerability of AWS Elastic Beanstalk CNAME Records by deleting them from AWS Route 53 using Python.

Using Terraform

# Remove this aws_route53_record from Terraform to delete the dangling Elastic Beanstalk CNAME.
# WARNING: This is destructive and will permanently delete the DNS record.
# WARNING: Verify the Elastic Beanstalk environment this CNAME pointed to has been terminated and is no longer needed.

resource "aws_route53_record" "ELB_DANGLING_CNAME" {
  zone_id = "HOSTED_ZONE_ID"          # Replace with the Route 53 hosted zone ID (e.g., Z123EXAMPLE)
  name    = "VULNERABLE_SUBDOMAIN"    # Replace with the current CNAME record name (e.g., app.example.com)
  type    = "CNAME"
  ttl     = 300                       # Replace with the existing TTL if different

  records = [
    "OLD_ELASTIC_BEANSTALK_CNAME"     # Replace with the current EB CNAME target (e.g., myenv.us-east-1.elasticbeanstalk.com)
  ]
}

To remediate, delete this aws_route53_record block from your Terraform configuration (or from the module where it is defined) so Terraform plans to destroy the record.

terraform plan should then show:

• one aws_route53_record marked with - destroy corresponding to the vulnerable CNAME.