> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # AWS Elastic Beanstalk CNAME Records Vulnerable To Takeover ### More Info: AWS Elastic Beanstalk CNAME Records Vulnerable To Takeover ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using the AWS console, follow these steps: 1. Sign in to the AWS Management Console. 2. Go to the Route53 service. 3. In the Route53 dashboard, select the hosted zone where the Elastic Beanstalk CNAME record is present. 4. Locate the CNAME record associated with your Elastic Beanstalk environment. 5. Click on the CNAME record to select it. 6. Choose the "Actions" dropdown menu and click on "Delete record set" to remove the vulnerable CNAME record. 7. Confirm the deletion by clicking on "Yes, Delete". 8. Once the CNAME record is deleted, you need to create an Alias record to point to the Elastic Beanstalk environment. 9. Click on the "Create record set" button. 10. In the "Name" field, enter the subdomain or hostname you want to associate with the Elastic Beanstalk environment. 11. Set the "Type" field to "A - IPv4 address". 12. Check the "Alias" checkbox. 13. In the "Alias target" field, select your Elastic Beanstalk environment from the dropdown list. 14. Click on the "Create" button to create the Alias record. 15. Verify that the new Alias record is created and points to the correct Elastic Beanstalk environment. By following these steps, you have successfully remediated the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using the AWS console. # To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using AWS CLI, follow these steps: 1. Open the AWS Command Line Interface (CLI) on your local machine. 2. Ensure that you have the AWS CLI installed and configured with the necessary credentials to access your AWS account. 3. Identify the misconfigured CNAME record associated with your Elastic Beanstalk environment. You can do this by listing the hosted zones in Route53 and locating the relevant Elastic Beanstalk environment. Run the following command to list all the hosted zones in Route53: ``` aws route53 list-hosted-zones ``` Identify the hosted zone corresponding to your Elastic Beanstalk environment. 4. Once you have identified the hosted zone, you need to update the CNAME record to make it more secure. You can achieve this by following these sub-steps: a. Get the current record set for the CNAME record using the `list-resource-record-sets` command. Replace `HOSTED_ZONE_ID` with the ID of your hosted zone and `CNAME_RECORD_NAME` with the name of your CNAME record. ``` aws route53 list-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --query "ResourceRecordSets[?Name == 'CNAME_RECORD_NAME']" ``` b. Make a note of the `TTL`, `Name`, `Type`, and `ResourceRecords` values from the command output. c. Delete the existing CNAME record using the `change-resource-record-sets` command. Replace `HOSTED_ZONE_ID` with the ID of your hosted zone and `CNAME_RECORD_NAME` with the name of your CNAME record. ``` aws route53 change-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --change-batch '{"Changes":[{"Action":"DELETE","ResourceRecordSet":{"Name":"CNAME_RECORD_NAME","Type":"CNAME","TTL":TTL,"ResourceRecords": [{"Value": "EXISTING_VALUE"}]}}]}' ``` Replace `EXISTING_VALUE` with the existing value of the CNAME record. d. Create a new CNAME record using the `change-resource-record-sets` command. Replace `HOSTED_ZONE_ID` with the ID of your hosted zone, `CNAME_RECORD_NAME` with the name of your CNAME record, `NEW_VALUE` with the desired value of the CNAME record, and `TTL` with the desired TTL value. ``` aws route53 change-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --change-batch '{"Changes":[{"Action":"CREATE","ResourceRecordSet":{"Name":"CNAME_RECORD_NAME","Type":"CNAME","TTL":TTL,"ResourceRecords": [{"Value": "NEW_VALUE"}]}}]}' ``` Replace `NEW_VALUE` with the new desired value for the CNAME record. 5. Verify that the CNAME record has been updated successfully by running the `list-resource-record-sets` command again and ensuring that the new record is present. ``` aws route53 list-resource-record-sets --hosted-zone-id HOSTED_ZONE_ID --query "ResourceRecordSets[?Name == 'CNAME_RECORD_NAME']" ``` By following these steps, you should be able to remediate the vulnerability of AWS Elastic Beanstalk CNAME Records in AWS Route53 using AWS CLI. To remediate the vulnerability of AWS Elastic Beanstalk CNAME Records, you can follow the steps below using Python: 1. Install the required Python packages: ```shell theme={null} pip install boto3 ``` 2. Import the necessary modules in your Python script: ```python theme={null} import boto3 ``` 3. Create a function to retrieve the CNAME records for your Elastic Beanstalk environment: ```python theme={null} def get_eb_cname_records(environment_name): client = boto3.client('elasticbeanstalk') response = client.describe_environments(EnvironmentNames=[environment_name]) cname_records = response['Environments'][0]['CNAME'] return cname_records ``` 4. Create a function to delete the CNAME records from AWS Route 53: ```python theme={null} def delete_route53_cname_records(cname_records, hosted_zone_id): client = boto3.client('route53') changes = [] for cname in cname_records: change = { 'Action': 'DELETE', 'ResourceRecordSet': { 'Name': cname, 'Type': 'CNAME', 'TTL': 300, 'ResourceRecords': [{'Value': cname}] } } changes.append(change) response = client.change_resource_record_sets( HostedZoneId=hosted_zone_id, ChangeBatch={ 'Changes': changes } ) return response ``` 5. Call the functions and pass the required parameters to delete the CNAME records: ```python theme={null} environment_name = 'your_environment_name' hosted_zone_id = 'your_hosted_zone_id' cname_records = get_eb_cname_records(environment_name) response = delete_route53_cname_records(cname_records, hosted_zone_id) print(response) ``` Note: Make sure you have the necessary permissions to access Elastic Beanstalk and Route 53 services. Also, replace 'your\_environment\_name' and 'your\_hosted\_zone\_id' with the appropriate values specific to your environment and hosted zone. These steps will help you remediate the vulnerability of AWS Elastic Beanstalk CNAME Records by deleting them from AWS Route 53 using Python. ```hcl theme={null} # Remove this aws_route53_record from Terraform to delete the dangling Elastic Beanstalk CNAME. # WARNING: This is destructive and will permanently delete the DNS record. # WARNING: Verify the Elastic Beanstalk environment this CNAME pointed to has been terminated and is no longer needed. resource "aws_route53_record" "ELB_DANGLING_CNAME" { zone_id = "HOSTED_ZONE_ID" # Replace with the Route 53 hosted zone ID (e.g., Z123EXAMPLE) name = "VULNERABLE_SUBDOMAIN" # Replace with the current CNAME record name (e.g., app.example.com) type = "CNAME" ttl = 300 # Replace with the existing TTL if different records = [ "OLD_ELASTIC_BEANSTALK_CNAME" # Replace with the current EB CNAME target (e.g., myenv.us-east-1.elasticbeanstalk.com) ] } ``` To remediate, delete this `aws_route53_record` block from your Terraform configuration (or from the module where it is defined) so Terraform plans to destroy the record. `terraform plan` should then show: * one `aws_route53_record` marked with `- destroy` corresponding to the vulnerable CNAME.