aws-java-sdk-core: EC2MetadataClient.java - Adds sending of a User-Ag…

[willbengtson]

Adds the sending of a User-Agent other than default User-Agent in Java when making requests to metadata service

Similar to AWS Golang SDK and now AWS Ruby SDK, send a User-Agent when making requests to metadata for credentials.
Golang uses a structure like aws-sdk-go/1.8.19 and now Ruby uses aws-sdk-ruby3/ as of PR #1762. PR #1445 adds this for python as well.

This will enable protection of AWS credentials from Server Side Request Foregery (SSRF) vectors by use of a metadata proxy and rejecting User-Agents that do not meet a regex.

[varunnvs92]

Can you provide more details on how change this would prevent SSRF?

[willbengtson]

@varunnvs92 sure thing! By providing a User-Agent that is predictable, you can build a metadata proxy to put on your instance that inspects the User-Agent sent in the request. If the User-Agent does not match or fit the pattern you are expecting then you can block that request.

Right now, there is not a reasonable way to do so since the default User-Agent is Java/<jre version>.

With SSRF, the attacker is tricking your application to make the request and if an attacker knows you run in AWS, a common tactic is to pull AWS credentials via SSRF to the metadata service.

[willbengtson]

I should add that with a successful SSRF, the request would be coming from the library the application uses for HTTP requests, which if no User-Agent is set would be the same as what the SDK uses currently.

[varunnvs92]

Should the third parameter be headers variable created above?

[willbengtson]

good catch. Will update!

[varunnvs92]

I have made the change internally. It will be included in today's release.

[muhqu]

@willbengtson, @varunnvs92 It looks like this PR was incomplete. When the SDK fetches credentials for from the EC2 metadata service it does so by making two http requests.

1. GET /latest/meta-data/iam/security-credentials/
   To get the name of the IAM Instance Profile. Here User-Agent: aws-sdk-java/{version} is added.
2. GET /latest/meta-data/iam/security-credentials/some-ec2-iam-role-abcdef
   To retrieve the credentials. Here the SDK User-Agent is still missing.

This is because the EC2CredentialsFetcher is directly supplying the headers map...

aws-sdk-java/aws-java-sdk-core/src/main/java/com/amazonaws/auth/EC2CredentialsFetcher.java

Lines 121 to 124 in 9d9bc2f

	String credentialsResponse = EC2CredentialsUtils.getInstance().readResource(
	credentialsEndpointProvider.getCredentialsEndpoint(),
	credentialsEndpointProvider.getRetryPolicy(),
	credentialsEndpointProvider.getHeaders());

... and therefor does not get the defaults defined here…

aws-sdk-java/aws-java-sdk-core/src/main/java/com/amazonaws/internal/EC2CredentialsUtils.java

Lines 81 to 88 in 9d9bc2f

	public String readResource(URI endpoint) throws IOException {
	Map<String, String> headers = new HashMap<String, String>();
	headers.put("User-Agent", USER_AGENT);
	headers.put("Accept", "*/*");
	headers.put("Connection", "keep-alive");
	return readResource(endpoint, CredentialsEndpointRetryPolicy.NO_RETRY, headers);
	}

I think it would be better to add the default headers here…

aws-sdk-java/aws-java-sdk-core/src/main/java/com/amazonaws/internal/EC2CredentialsUtils.java

Lines 110 to 113 in 9d9bc2f

	public String readResource(URI endpoint, CredentialsEndpointRetryPolicy retryPolicy, Map<String, String> headers) throws IOException {
	int retriesAttempted = 0;
	InputStream inputStream = null;

WDYT?

[willbengtson]

@muhqu I think this makes sense. Good catch.