Public Subscription Access of SNS Topics via Policy

ID: sns-public-subscribe-access

Severity: high

Author: Ritesh_Gohil(#L4stPL4Y3R)

Tags: cloud,devops,aws,amazon,sns,aws-cloud-config

Description

This template checks if Amazon SNS topics are configured to allow public subscription access via topic policies.

YAML Source

id: sns-public-subscribe-access

info:
  name: Public Subscription Access of SNS Topics via Policy
  author: Ritesh_Gohil(#L4stPL4Y3R)
  severity: high
  description: |
    This template checks if Amazon SNS topics are configured to allow public subscription access via topic policies.
  reference:
    - https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html
  tags: cloud,devops,aws,amazon,sns,aws-cloud-config

flow: |
  code(1)
  for (let topicArn of iterate(template.topics)) {
    set("topicArn", topicArn)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws sns list-topics --query 'Topics[*].TopicArn'

    extractors:
      - type: json
        internal: true
        name: topics
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      aws sns get-topic-attributes --topic-arn $topicArn --query Attributes.Policy --output text

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Effect":"Allow"'

      - type: word
        part: body
        words:
          - '"Principal":{"AWS":"*"}'

      - type: word
        part: body
        words:
          - '"Action":"SNS:Subscribe"'

      - type: regex
        part: body
        negative: true
        regex:
          - '"Condition"'

    extractors:
      - type: dsl
        dsl:
          - '"The SNS topic " + topicArn + " allows public subscription via Policy"'
# digest: 4a0a004730450221008a967d8e5c9942beefab71caa02bdc0fd01121f2c88254d8a37296a941f8e02c02200d45a3425f5011f61061b5004635f3ad9407bcd88ae47fcda6afc63e883b432d:366f2a24c8eb519f6968bd8801c08ebe

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/aws/sns/sns-public-subscribe-access.yaml"

View on Github