Plesk Obsidian Unauthenticated AWS Credentials Exposure Vulnerability

A vulnerability in Plesk Obsidian version 18.0.69 allows unauthenticated requests to the login_up.php endpoint to access sensitive AWS credentials. This includes the accessKeyId, secretAccessKey, region, and endpoint. The exposure of these credentials can lead to unauthorized access to the AWS account associated with them.

Impact

Exploitation of this vulnerability allows for unauthorized access to AWS accounts using the exposed credentials, potentially leading to full access rights, as demonstrated by the ability to execute AWS CLI commands such as 'aws sts get-caller-identity'.

Reproduction

The vulnerability can be reproduced by sending an unauthenticated request to the '/login_up.php' endpoint on a Plesk Obsidian 18.0.69 server. The response will include exposed AWS credentials in a JavaScript payload, which can then be used to access the AWS account via the AWS CLI.