How to remediate – Amazon Web Services EC2 Instance Metadata Enumeration (Windows)

1. Introduction

Amazon Web Services EC2 Instance Metadata Enumeration (Windows) refers to the ability to retrieve information about an AWS EC2 instance using its metadata API. This can expose sensitive data, such as IAM roles and credentials. Affected systems are typically Windows-based Amazon Machine Images running on EC2 instances. A successful exploit could lead to compromise of confidentiality, integrity, and availability due to potential credential theft and unauthorized access.

2. Technical Explanation

The vulnerability occurs because the metadata API is accessible from within the instance by default. An attacker who gains access to an EC2 instance can query this API to obtain sensitive information. There isn’t a specific CVE associated with this general enumeration capability, but it’s often exploited in conjunction with other vulnerabilities or misconfigurations. For example, an attacker could use PowerShell scripts to retrieve IAM roles and credentials from the metadata service. Affected platforms are Windows EC2 instances.

• Root cause: The instance metadata API is accessible by default without strong access controls.
• Exploit mechanism: An attacker executes commands within the compromised instance to query the metadata API (e.g., using PowerShell).
• Scope: Windows EC2 instances running on AWS.

3. Detection and Assessment

To confirm vulnerability, check for access to the metadata endpoint from within the instance. A thorough method involves attempting to retrieve specific metadata values.

• Quick checks: Open a PowerShell prompt and attempt to access the metadata service using Invoke-RestMethod http://169.254.169.254/latest/meta-data/iam/security-credentials/. If successful, this indicates the API is accessible.
• Scanning: Nessus vulnerability ID 138780 can detect metadata exposure. This should be used as an example only.
• Logs and evidence: Examine system logs for PowerShell commands querying http://169.254.169.254. Event IDs related to network connections or process execution may provide clues.

Invoke-RestMethod http://169.254.169.254/latest/meta-data/iam/security-credentials/

4. Solution / Remediation Steps

The primary solution is to restrict access to the metadata API using firewall rules or IAM roles with limited permissions.

4.1 Preparation

• Roll back plan: Restore from the snapshot if issues occur. Change window approval may be required for production systems.

4.2 Implementation

1. Step 1: Create a Windows Firewall rule to block outbound access to IP address 169.254.169.254 on all ports.
2. Step 2: Alternatively, configure IAM roles with the least privilege necessary for the instance to function. Avoid granting broad permissions that allow metadata API access.

4.3 Config or Code Example

Before

# No firewall rule blocking 169.254.169.254

After

New-NetFirewallRule -DisplayName "Block Metadata API" -Direction Outbound -RemoteAddress 169.254.169.254/32 -Action Block

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege is crucial, as it limits the impact of a compromised instance. Input validation isn’t directly applicable here but is important for other vulnerabilities. Secure defaults and patch cadence are also relevant to overall system hardening.

• Practice 1: Implement least privilege IAM roles to restrict access to only necessary resources.
• Practice 2: Regularly review and update security groups and firewall rules.

4.5 Automation (Optional)

Automation can be used to deploy firewall rules at scale using PowerShell or infrastructure-as-code tools like Terraform.

# Example PowerShell script to block metadata API access across multiple instances
# Requires appropriate permissions and AWS credentials
# Caution: This script will modify firewall rules on all targeted instances. Test thoroughly before deploying to production.
# Get a list of EC2 instance IDs
# $Instances = Get-EC2Instance -Filter '...'
# ForEach ($Instance in $Instances) {
#   New-NetFirewallRule -DisplayName "Block Metadata API" -Direction Outbound -RemoteAddress 169.254.169.254/32 -Action Block -ComputerName $Instance.InstanceId
# }

5. Verification / Validation

• Post-fix check: Open a PowerShell prompt and attempt to access the metadata service using Invoke-RestMethod http://169.254.169.254/latest/meta-data/iam/security-credentials/. The command should fail with an error indicating that the connection was blocked or refused.
• Re-test: Run the earlier detection method (PowerShell query) to confirm access is now denied.
• Monitoring: Monitor firewall logs for blocked connections to 169.254.169.254 as an example alert.

Invoke-RestMethod http://169.254.169.254/latest/meta-data/iam/security-credentials/

6. Preventive Measures and Monitoring

Update security baselines to include restrictions on metadata API access. Implement checks in CI/CD pipelines to ensure firewall rules are correctly configured during deployment. Maintain a sensible patch or config review cycle that fits the risk profile.

• Baselines: Update your Windows hardening baseline (e.g., CIS benchmark) to include blocking outbound connections to 169.254.169.254.
• Pipelines: Add checks in your CI/CD pipeline to validate firewall rules on new EC2 instances.
• Asset and patch process: Review security group configurations regularly, at least quarterly.

7. Risks, Side Effects, and Roll Back

Blocking access to the metadata API may impact applications that rely on it for dynamic configuration or credential retrieval. The roll back steps involve removing the firewall rule or adjusting IAM role permissions.

• Risk or side effect 1: Applications requiring metadata API access will fail if blocked without proper configuration.
• Risk or side effect 2: Incorrectly configured IAM roles may prevent legitimate services from functioning.
• Roll back: Step 1: Remove the firewall rule using Remove-NetFirewallRule -DisplayName "Block Metadata API". Step 2: Restore original IAM role permissions if necessary.

8. References and Resources

• Vendor advisory or bulletin: https://docs.aws.amazon.com/ec2/index.html
• NVD or CVE entry: Not applicable for general enumeration, but related exploits may have entries.
• Product or platform documentation relevant