Security News > 2022 > January > AWS fixes security flaws that exposed AWS customer data
Amazon Web Services has addressed an AWS Glue security issue that allowed attackers to access and alter data linked to other AWS customer accounts.
The flaw stemmed from an exploitable AWS Glue feature and an internal service API misconfiguration that allowed Orca Security security researchers to escalate privileges to gain access to all service resources in the region.
"During our research, we were able to identify a feature in AWS Glue that could be exploited to obtain credentials to a role within the AWS service's own account, which provided us full access to the internal service API," explained Yanir Tsarimi, a Cloud Security Researcher at Orca Security.
The researchers added that their findings were uncovered using only Orca Security-owned AWS accounts and that they didn't access information or data belonging to other AWS customers during their research.
AWS' Security Team has also patched a second vulnerability found by Orca Security in the AWS CloudFormation service.
AWS VP Colm MacCárthaigh denied the security firm's claims, saying that the BreakingFormation bug could have only been used to access host-level credentials and that AWS CloudFormation hosts don't have access to resources in all AWS accounts.