Exposed Cloud Functions Pose Significant Risk, Mandiant Warns
Mandiant highlights the risks of improperly secured serverless applications, which can be exploited by attackers to gain initial access and potentially compromise entire cloud environments.
Mandiant security assessments frequently uncover publicly exposed serverless applications that lack essential authentication mechanisms, often due to specific business requirements. These serverless deployments, typically running custom-developed code and incorporating third-party packages, are prime targets for a wide array of application-level attacks. Common threats include Local and Remote File Inclusion (LFI/RFI) and Command Injection vulnerabilities. Successful exploitation of these weaknesses can grant attackers full control over the underlying container instance, providing a critical foothold that may ultimately lead to a complete compromise of the victim's cloud environment.
Serverless applications, also known as Function-as-a-Service (FaaS), enable the deployment of individual code blocks as microservices within a flexible, decoupled, and event-driven cloud architecture. This approach eliminates the need for managing underlying infrastructure, allowing services to scale automatically and deploy instantly. The rapid expansion of generative AI adoption is a significant driver for increased serverless architecture use, with AI workflows relying heavily on these functions for tasks like chatbot interactions and image generation. This growth, however, intensifies the challenge for enterprise security teams tasked with securing these environments.
Publicly exposed serverless workloads can serve as an initial access point for threat actors. Vulnerabilities may exist within the application code itself, imported packages, or the underlying runtime environment. Once an entry point is exploited, attackers typically attempt to escalate privileges or move laterally within the compromised environment. Common techniques observed include extracting secrets directly embedded within the application code, analyzing application logic for further attack vectors, and exfiltrating service account bearer tokens from the metadata server following successful Remote Code Execution (RCE).
Leveraging compromised secrets or service accounts allows threat actors to pivot to adjacent systems and workloads. Without proper hardening strategies, this can lead to a total environment takeover. For instance, a common scenario involves a Python/Flask function accepting user-controlled input for file operations without adequate validation, leading to a Local File Inclusion (LFI) vulnerability. An attacker could then exploit this to retrieve sensitive files like source code, configuration files, or environment variables containing hardcoded secrets.
Another critical attack vector is Code Execution or Command Injection. In scenarios where a serverless function uses shell execution methods with unsanitized user input, attackers can execute arbitrary commands on the underlying container. This could allow them to install malicious software, access sensitive data, or establish persistent access. For example, a function that processes user input to construct a system command without proper sanitization is highly vulnerable.
Mandiant emphasizes that secrets or credentials should never be stored within source code or local container files. Instead, organizations must utilize dedicated secrets management solutions, such as Google Cloud's Secret Manager. Furthermore, robust access controls are paramount. Serverless functions should adhere to the principle of least privilege, with service accounts granted only the necessary permissions to perform their intended tasks.
To mitigate these risks, Mandiant recommends several hardening strategies. Developers should rigorously validate all user inputs, sanitize data used in system commands, and avoid executing external commands whenever possible. Implementing security scanning tools for code and dependencies can help identify known vulnerabilities in third-party packages. Regular security assessments and penetration testing of serverless deployments are also crucial for uncovering misconfigurations and exploitable flaws before attackers can.
In conclusion, while serverless architectures offer significant benefits in terms of scalability and agility, their security requires careful attention. Misconfigurations and insecure coding practices can transform these powerful tools into critical entry points for attackers. By implementing robust access controls, secure coding practices, and diligent security monitoring, organizations can significantly reduce the risk associated with exposed cloud functions and protect their cloud environments.