Two security reports and how we responded

Atlas participates in Defend Iceland, the Icelandic bug bounty platform where security researchers systematically probe the systems of participating companies. Through the platform we received two reports about access control in Atlas Cloud. Both were valid. This post explains each of them and how we responded.

The first report: read-only access that could change and delete

Three roles govern access to the Atlas Cloud portal: Atlas ReadOnly, Atlas User and Atlas Admin. A researcher demonstrated that ReadOnly, which is only meant to grant read access, could both change and delete settings. The role turned out not to be as dependable as intended.

We fixed this by making sure that every operation not explicitly allowed was denied, dangerous ones among them. Finally, we confirmed the outcome with tests across all three roles. The roles now live up to their name: ReadOnly only reads, User creates and edits but deletes nothing, and Admin holds full control over its own domain.

The second report: the keys to the object store

The call that lists buckets in the object store returns the account's access keys along with the response. The keys the ReadOnly and User roles received for buckets are account-wide, so anyone who could list buckets in effect held full read, write and delete access to all of the account's data in the store.

We responded by moving all bucket operations to the Admin role. ReadOnly and User can neither see nor manage buckets, so the keys accompany Admin access only, which holds full control over the account in any case.

What this means for customers

• Atlas ReadOnly reads resources and changes nothing.
• Atlas User creates and edits resources, deletes nothing, and does not see buckets.
• Atlas Admin holds full control over its domain, including buckets and deletions.

Customers using the object store manage buckets and retrieve keys from an Admin account. The roles and the object store are covered in more detail in the Atlas documentation.

Thanks

We thank the researcher and Defend Iceland for well-made reports with clear demonstrations that held up under scrutiny. Independent security research is part of how Atlas works, and reports like these make the service safer for everyone. We welcome the fact that the world of honest hackers found a flaw, as is its purpose.

If you believe you have found a vulnerability, we ask you to report a security issue or to drop us a line at security@atlascloud.is.