From be712deffb0ebd24a17655a232e05c78a5a8dea4 Mon Sep 17 00:00:00 2001
From: Translator <github-actions@github.com>
Date: Thu, 23 Oct 2025 21:53:34 +0000
Subject: [PATCH] Translated
 ['src/pentesting-cloud/aws-security/aws-post-exploitation/aws

---
 .../aws-mwaa-post-exploitation/README.md      | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md

diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
new file mode 100644
index 000000000..a9811ab29
--- /dev/null
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
@@ -0,0 +1,44 @@
+# AWS MWAA Execution Role Account Wildcard Vulnerability
+
+## Η Τρωτότητα
+
+Ο execution role του MWAA (ο IAM role που χρησιμοποιούν οι Airflow workers για πρόσβαση σε πόρους του AWS) απαιτεί την ακόλουθη υποχρεωτική policy για να λειτουργήσει:
+```json
+{
+"Effect": "Allow",
+"Action": [
+"sqs:ChangeMessageVisibility",
+"sqs:DeleteMessage",
+"sqs:GetQueueAttributes",
+"sqs:GetQueueUrl",
+"sqs:ReceiveMessage",
+"sqs:SendMessage"
+],
+"Resource": "arn:aws:sqs:us-east-1:*:airflow-celery-*"
+}
+```
+The wildcard (`*`) in the account ID position allows the role to interact with **οποιαδήποτε SQS ουρά σε οποιονδήποτε AWS λογαριασμό** that starts with `airflow-celery-`. This is required because AWS provisions MWAA's internal queues in a separate AWS-managed account. There is no restriction on making queues with the `airflow-celery-` prefix.
+
+**Δεν μπορεί να διορθωθεί:** Removing the wildcard pre-deployment breaks MWAA completely - the scheduler can't queue tasks for workers.
+
+Τεκμηρίωση που Επαληθεύει την Ευπάθεια και Αναγνώριση του Vectorr: [AWS Documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html)
+
+## Εκμετάλλευση
+
+All Airflow DAGs run with the execution role's permissions. DAGs are Python scripts that can execute arbitrary code - they can use `yum` or `curl` to install tools, download malicious scripts, or import any Python library. DAGs are pulled from an assigned S3 folder and run on schedule automatically, all an attacker needs is ability to PUT to that bucket path.
+
+Οποιοσδήποτε μπορεί να γράψει DAGs (τυπικά οι περισσότεροι χρήστες σε περιβάλλοντα MWAA) μπορεί να καταχραστεί αυτό το δικαίωμα:
+
+1. **Data Exfiltration**: Create a queue named `airflow-celery-exfil` in an external account, write a DAG that sends sensitive data to it via `boto3`
+
+2. **Command & Control**: Poll commands from an external queue, execute them, return results - creating a persistent backdoor through SQS APIs
+
+3. **Cross-Account Attacks**: Inject malicious messages into other organizations' queues if they follow the naming pattern
+
+All attacks bypass network controls since they use AWS APIs, not direct internet connections.
+
+## Επιπτώσεις
+
+This is an architectural flaw in MWAA with no IAM-based mitigation. Every MWAA deployment following AWS documentation has this vulnerability.
+
+**Παράκαμψη Ελέγχων Δικτύου:** These attacks work even in private VPCs with no internet access. The SQS API calls use AWS's internal network and VPC endpoints, completely bypassing traditional network security controls, firewalls, and egress monitoring. Organizations cannot detect or block this data exfiltration path through network-level controls.