Aqua Security Researchers Disclose Series of AWS Flaws

Aqua Security presented research at Black Hat USA 2024 revealing six vulnerabilities across multiple AWS services that relied on predictable S3 bucket naming. Researchers showed how attackers could pre-create those buckets (“Bucket Monopoly”), store malicious code, and cause targeted organizations to execute that code when enabling a service in a new region—potentially leading to RCE, administrative account creation, data exposure/exfiltration, and denial-of-service. AWS has patched the issues and reported no customer action required or evidence of active exploitation.