Stealing OAuth Github Tokens with AWS CodeBuild

AWS CodeBuild was patched to prevent unauthorized HTTP traffic, but an attacker can still leverage custom Docker containers to perform man-in-the-middle attacks and steal GitHub OAuth tokens from within the build environment.

Key Takeaways:
• AWS removed the vulnerability that allowed proxying traffic via HTTP, but introduced a feature that lets users execute builds inside custom Docker images, creating a new attack surface. 4:45
• By configuring a custom Docker container with a man-in-the-middle proxy and a custom CA certificate, an attacker can intercept the connection between CodeBuild and GitHub to capture sensitive OAuth tokens. 10:30
• This vulnerability highlights a structural difference from other providers like Google Cloud Platform; AWS exposes the GitHub connection to the build process, whereas GCP handles token distribution internally to prevent interception. 12:31

This technique serves as a "reverse" pivot method, demonstrating how compromising a CI/CD provider can expose secrets from external cloud services like GitHub.

Sources:

• 1:20 Explanation of AWS CodeBuild
• 4:45 Introduction of the Docker workaround
• 7:36 Configuration of the malicious Docker image
• 10:30 Execution of the MITM attack
• 12:31 Comparison with Google Cloud Platform and security strategies