pacu icon indicating copy to clipboard operation
pacu copied to clipboard

iam__backdoor_assume_role overwrites IAM boto client object when user arn is not specified

Open ishmandoo opened this issue 2 years ago • 1 comments

It looks like this line is looking for an IAM boto client object. However, client gets overwritten with an STS boto client on line 80 if a user arn is not specified.

https://github.com/RhinoSecurityLabs/pacu/blob/e95b3ff2898b4954fe61411b314414b33e1f5750/pacu/modules/iam__backdoor_assume_role/main.py#L105

The result is an error like this: <class 'AttributeError'>: 'STS' object has no attribute 'update_assume_role_policy'

ishmandoo avatar Sep 08 '21 17:09 ishmandoo

I just put up a PR proposing a fix: #304

ishmandoo avatar Sep 11 '21 14:09 ishmandoo

Looks like this was merged and fixed

DaveYesland avatar Apr 20 '23 16:04 DaveYesland