T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/setup_deployer_role.sh:150
- Finding
- Deployer IAM Policy Permits Privilege Escalation Through Arbitrary Role Policies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_deployer_role.sh`, lines 150-171 **Vulnerability Type**: Excessive IAM role-management and role-passing permissions **Risk Level**: High ### Vulnerable Code ```bash { "Sid": "IAMRoleManagement", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:TagRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:PassRole", "iam:SimulatePrincipalPolicy", "iam:ListRoleTags", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource": [ "arn:aws:iam::${ACCOUNT_ID}:role/*-role", "arn:aws:iam::${ACCOUNT_ID}:instance-profile/*-instance-profile", "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" ] } ``` ### Technical Analysis The generated deployer policy permits `iam:CreateRole`, `iam:PutRolePolicy`, and `iam:PassRole` for every account role whose name ends in `-role`. The `iam:PutRolePolicy` permission allows the deployer to supply arbitrary inline policy documents; no permissions boundary constrains the maximum privileges assignable to a newly created role. The deployer also has `ec2:RunInstances` on all resources. Combining role creation, arbitrary inline policy assignment, role passing, instance-profile management, and EC2 launch privileges creates a conventional IAM privilege-escalation chain. The permissions are broader than necessary to manage the single `${NAME}-role` required by an OpenClaw deployment. ### Attack Path 1. Obtain or compromise credentials for the OpenClaw deployer identity. 2. Create an IAM role with a permitted suffix, such as `attacker-role`. 3. Use `iam:PutRolePolicy` to assign that role an administrator-equivalent inline policy. 4. Create an instance profile and ...[truncated 606 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Restrict role and instance-profile resources to an exact controlled prefix, such as `arn:aws:iam::<account>:role/openclaw-*`. - Require a permissions boundary on every created role and deny creation or modification without that boundary. - Restrict `iam:PassRole` with both an exact role ARN and: ```json "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } ``` - Separate role provisioning from routine deployment. A trusted administrator should provision a fixed instance role in advance, while the deployer should only be able to pass that role. - Remove `iam:PutRolePolicy`, `iam:CreateRole`, and instance-profile creation from the routine deployer wherever possible. - Add explicit deny guardrails through an SCP or permissions boundary to prevent administrator, IAM-management, organization-management, and security-control privileges from being assigned. ]]>