AWS Elastic Beanstalk Alias Records Vulnerable To Takeover

More Info:

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the vulnerability of AWS Elastic Beanstalk Alias Records in AWS Route53 using the AWS console, follow these step-by-step instructions:

Log in to the AWS Management Console.
Go to the Route53 service by selecting it from the list of available services.
In the Route53 dashboard, click on "Hosted zones" in the left-hand navigation pane.
Select the hosted zone that contains the Elastic Beanstalk Alias Records you want to remediate.
In the hosted zone details, you will see a list of records. Identify the Alias Records associated with Elastic Beanstalk.
Click on the Alias Record that you want to remediate.
In the record details, click on the "Edit" button.
In the "Alias Target" field, you will see the current value pointing to the Elastic Beanstalk environment.
To remediate the vulnerability, change the Alias Target to a secure target, such as an Elastic Load Balancer or CloudFront distribution associated with your Elastic Beanstalk environment.
Once you have updated the Alias Target, click on the "Save Record Set" button to apply the changes.
Repeat steps 6 to 10 for each Elastic Beanstalk Alias Record that needs remediation.
Verify that the changes have been applied successfully by checking the status of the updated records in the hosted zone details.

By following these steps, you will be able to remediate the vulnerability of AWS Elastic Beanstalk Alias Records in AWS Route53 using the AWS console.

Using CLI

To remediate the vulnerability of AWS Elastic Beanstalk Alias Records in AWS Route53 using AWS CLI, follow these steps:

Open the AWS Command Line Interface (CLI) on your local machine.
Ensure that you have the latest version of the AWS CLI installed. You can check the version by running the command:
```
aws --version
```
Configure the AWS CLI with your AWS credentials by running the command:
```
aws configure
```
This will prompt you to enter your AWS Access Key ID, Secret Access Key, default region name, and output format. Provide the required information accordingly.
Verify that you have the necessary permissions to make changes to Route53. Ensure that the IAM user or role associated with your AWS CLI credentials has the required permissions to manage Route53 resources.
Identify the Elastic Beanstalk Alias Record that needs to be remediated. You can list all the hosted zones in Route53 using the command:
```
aws route53 list-hosted-zones
```
Once you have identified the hosted zone containing the Elastic Beanstalk Alias Record, note down its Zone ID.
To update the Alias Record, use the following command:
```
aws route53 change-resource-record-sets --hosted-zone-id <zone-id> --change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"<record-name>","Type":"A","AliasTarget":{"HostedZoneId":"<alias-target-hosted-zone-id>","DNSName":"<alias-target-dns-name>","EvaluateTargetHealth":false}}}]}' 
```
Replace <zone-id> with the Zone ID of the hosted zone, <record-name> with the name of the Alias Record, <alias-target-hosted-zone-id> with the Hosted Zone ID of the target resource, and <alias-target-dns-name> with the DNS name of the target resource.

Note: Ensure that you replace the values within < > with the appropriate values specific to your environment.
After executing the command, the Alias Record will be updated, and the vulnerability will be remediated.

Remember to validate the changes and test the functionality of the Alias Record after remediation.

Using Python

To remediate the vulnerability of AWS Elastic Beanstalk Alias Records in AWS Route53 using Python, follow these steps:

Install the required Python packages:
```
pip install boto3
```
Import the necessary modules in your Python script:
```
import boto3
```

Initialize the AWS Route53 client:

route53_client = boto3.client('route53')

Retrieve the hosted zones in your AWS Route53 account:

response = route53_client.list_hosted_zones()
hosted_zones = response['HostedZones']

Iterate through the hosted zones and retrieve the records:

for hosted_zone in hosted_zones:
    hosted_zone_id = hosted_zone['Id']
    response = route53_client.list_resource_record_sets(HostedZoneId=hosted_zone_id)
    records = response['ResourceRecordSets']

Identify the Elastic Beanstalk Alias Records in the records list:

for record in records:
    if record['Type'] == 'A' and 'AliasTarget' in record:
        # Perform necessary actions to remediate the vulnerability
        # For example, you can delete the Alias record using:
        route53_client.delete_resource_record_set(
            HostedZoneId=hosted_zone_id,
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'DELETE',
                        'ResourceRecordSet': record
                    }
                ]
            }
        )

Run the Python script to remediate the Elastic Beanstalk Alias Records vulnerability in AWS Route53.

Note: Make sure you have appropriate AWS credentials configured in your environment to access the AWS Route53 service.

Using Terraform

# This is the Route 53 alias record pointing at the (now non-existent) Elastic Beanstalk environment.
# To remediate the takeover risk, DELETE THIS RESOURCE FROM TERRAFORM so it is destroyed.
# WARNING: Destroying this record is irreversible and will remove DNS for this name.
# WARNING: Confirm the record is no longer needed and the target Elastic Beanstalk environment is terminated.

resource "aws_route53_record" "ELB_ALIAS_RECORD" {
  zone_id = "HOSTED_ZONE_ID"         # e.g. Z123456789ABC, the hosted zone ID
  name    = "VULNERABLE_ALIAS_NAME"  # e.g. app.example.com.
  type    = "A"

  alias {
    name                   = "ALIAS_TARGET_DNS_NAME"   # e.g. dead-env.elasticbeanstalk.com.
    zone_id                = "ALIAS_TARGET_HOSTED_ZONE_ID"
    evaluate_target_health = false
  }
}

This fix requires removing the aws_route53_record.ELB_ALIAS_RECORD resource from your Terraform configuration (or setting count = 0 on it) so that terraform apply issues a destroy for the dangling alias record; this permanently deletes the DNS record and may cause an outage for that name.

Verification: terraform plan should show the alias record as - destroy with the corresponding aws_route53_record being removed from the state.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​