{"id":"GHSA-q4pp-j36h-3gqg","aliases":[],"status":"published","title":"Minimal `basti` IAM Policy Allows Shell Access","description":"### Summary\n\nThe provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.\n\n### Details\n\n`basti connect` is designed to \"securely connect to your RDS/Aurora/Elasticache/EC2 instances\", using a bastion instance \"with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost.\"\n\nThe [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:\n\n```   \n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nThis statement does not include the following condition:\n\n```\n\"Condition\": {\n    \"BoolIfExists\": {\n        \"ssm:SessionDocumentAccessCheck\": \"true\"\n    }\n}\n```\n\nAs a result, the `basti connect` minimal policy is logically identical to:\n\n```\n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nA `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.\n\nFor more details on this footgun, see: https://ramimac.me/ssm-iam\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n\nImpact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-24T12:53:06Z","modified":"2023-08-24T12:53:06Z","fixes":[{"ecosystem":"npm","package":"basti-cdk","fixed_in":["1.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"basti-cdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"basti-cdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]}],"references":[{"url":"https://github.com/BohdanPetryshyn/basti/security/advisories/GHSA-q4pp-j36h-3gqg","tags":["web"]},{"url":"https://github.com/BohdanPetryshyn/basti/commit/f6f218e7cd450e29aeb616960b7abbe8dfc87796","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q4pp-j36h-3gqg"},{"url":"https://github.com/BohdanPetryshyn/basti","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-q4pp-j36h-3gqg","title":"Minimal `basti` IAM Policy Allows Shell Access","description":"### Summary\n\nThe provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.\n\n### Details\n\n`basti connect` is designed to \"securely connect to your RDS/Aurora/Elasticache/EC2 instances\", using a bastion instance \"with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost.\"\n\nThe [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:\n\n```   \n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nThis statement does not include the following condition:\n\n```\n\"Condition\": {\n    \"BoolIfExists\": {\n        \"ssm:SessionDocumentAccessCheck\": \"true\"\n    }\n}\n```\n\nAs a result, the `basti connect` minimal policy is logically identical to:\n\n```\n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nA `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.\n\nFor more details on this footgun, see: https://ramimac.me/ssm-iam\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n\nImpact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed. ","status":"published","published":"2023-08-24T12:53:06Z","modified":"2023-08-24T12:53:06Z","updated_at":"2026-11-02T14:37:00.680009Z"}],"osv":[{"id":"GHSA-q4pp-j36h-3gqg","title":"Minimal `basti` IAM Policy Allows Shell Access","description":"### Summary\n\nThe provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.\n\n### Details\n\n`basti connect` is designed to \"securely connect to your RDS/Aurora/Elasticache/EC2 instances\", using a bastion instance \"with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost.\"\n\nThe [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:\n\n```   \n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nThis statement does not include the following condition:\n\n```\n\"Condition\": {\n    \"BoolIfExists\": {\n        \"ssm:SessionDocumentAccessCheck\": \"true\"\n    }\n}\n```\n\nAs a result, the `basti connect` minimal policy is logically identical to:\n\n```\n {\n      \"Effect\": \"Allow\",\n      \"Action\": \"ssm:StartSession\",\n      \"Resource\": [\n        \"arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost\",\n        \"arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell\",\n        \"arn:aws:ec2:\u003cyour-region\u003e:\u003cyour-account-id\u003e:instance/\u003cyour-basti-instance-id\u003e\"\n      ]\n    }\n```\n\nA `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.\n\nFor more details on this footgun, see: https://ramimac.me/ssm-iam\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\n### Impact\n\nImpact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed. ","status":"published","published":"2023-08-24T12:53:06Z","modified":"2023-08-24T12:53:06Z","updated_at":"2026-11-02T15:46:54.055966Z"}]}}