BOOTSTRAP-01: Bootstrap supply chain — path traversal precondition¶
| Property | Value |
|---|---|
| Severity | critical |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Policy | P-02: Downloaded state is never executed as code |
| Mode | Active: writes and then removes probe objects. Skipped with --read-only. |
What a failure enables¶
- RCE as root in enclave
What it checks¶
It passes when:
- Bucket blocks path-traversal-shaped key writes. All … canary probes were rejected (…).
Example failures:
- Bucket allows path-traversal-shaped key writes (…/… probes accepted). S3 does not sanitize key names by design — exploitability depends on the enclave's download routine, but this precondition is necessary for the attack.
- Bucket allows path-traversal-shaped key writes (4/4 probes accepted). S3 does not sanitize key names by design — exploitability depends on the enclave's download routine, but this precondition is necessary for the attack.
How to fix¶
- Layer 1 (bucket policy): add a Deny statement that rejects s3:PutObject when the key contains '..' path components using an s3:prefix or StringLike condition. Layer 2 (enclave code): sanitize downloaded key names with os.path.normpath() and reject any resolved path that escapes the expected directory. Both layers should be applied.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No target bucket specified; skipping check.
ERROR:
- Transient S3 error during canary probe: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | s3.delete_object |
s3:DeleteObject |
write |
| AWS | s3.put_object |
s3:PutObject |
write |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: accepted_keys, block_reasons, blocked_keys, canary_cleanup
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).