The Dark Side of Flexibility: Detecting Risky Permission Chaining Attacks in Serverless Applications

The Dark Side of Flexibility: Detecting Risky Permission Chaining Attacks in Serverless Applications

Speakers: Xunqi Liu

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=_IRRES_HA64

Overview

Serverless computing decomposes applications into small, event-driven functions that execute independently within their own permission boundaries. While IAM policies evaluate each function's permissions in isolation, the decentralized, dynamic nature of serverless execution creates cross-function and cross-account permission chaining attacks that centralized IAM systems cannot detect. This talk reveals a fundamental architectural mismatch between centralized, static permission management (IAM) and decentralized, dynamic function execution -- a mismatch that enables attackers who compromise a single function to escalate privileges across accounts by chaining individually acceptable permissions through resource sharing mechanisms like cross-account Lambda layer publishing. The researchers identified 28 risky applications across two major cloud vendor serverless repositories, received 12 confirmations, multiple CVEs, and security bounties from Google and other vendors.

Background

▶ Watch: Serverless execution model vs centralized IAM permission management (2:00)

In serverless architectures, each function runs within its own execution role -- a permission boundary defined by IAM policies. Functions may invoke each other within an account or across accounts to complete tasks. IAM evaluates permissions per role, not per interaction path, meaning it cannot reason about the cumulative effect of permissions chained across multiple functions.

Resource sharing mechanisms -- such as cross-account Lambda layer publishing, shared codebases, and cross-account function invocation -- enable functions in different accounts to interact. When combined with individually acceptable but risky permissions (like sts:AssumeRole), these mechanisms create privilege escalation chains that span account boundaries.

Key Findings

▶ Watch: Real-world cross-account attack via Lambda layer sharing (6:00)

The researchers formalized the attack space along two dimensions: attacker capability (direct vs. indirect control) and service topology (intra-account vs. cross-account), yielding four theoretical patterns that reduce to three practical attack modalities: (1) direct intra-account escalation, (2) indirect intra-account escalation via function hijacking, and (3) cross-account escalation via shared resources. A validated real-world attack chain demonstrates: compromised function assumes account admin role, publishes malicious Lambda layer shareable cross-account, layer auto-executes in victim account function, attacker assumes victim account admin role -- both accounts fully compromised. Detection reduces to a graph construction and pruning problem under modality constraints, with nodes representing functions with risky permissions and edges representing escalation paths.

Technical Deep Dive

▶ Watch: Four attack patterns from two dimensions: capability and topology (8:00)

The detection tool builds an attack graph where each node is a function holding at least one risky permission. Graph construction traverses all IAM permissions granted to each function, retaining only risky permissions to prevent node explosion. Edges are built using the three attack modality frameworks: each modality defines escalation logic determining whether an edge should exist between two risky function nodes. Detection becomes constraint reachability analysis over the pruned graph. Performance evaluation shows near-linear runtime scaling with deployment size, completing analysis of large-scale mixed deployments in minutes.

Demo / Proof of Concept

▶ Watch: Graph-based detection with modality-constrained reachability (12:00)

Applied to two major cloud vendor serverless repositories, the tool identified 28 risky applications covering all three attack modalities. Twelve confirmations were received, along with multiple CVEs and security bounties from cloud vendors. The real-world attack example demonstrates cross-account privilege escalation through Lambda layer sharing, where each individual step is permitted by IAM policies but the chain achieves full account compromise.

Defensive Implications

▶ Watch: Results: 28 risky apps, 12 confirmed, multiple CVEs and bounties (14:00)

For cloud security teams, this research demonstrates that IAM policy reviews focused on individual roles are insufficient for serverless architectures. Cross-function and cross-account interaction paths must be analyzed as attack chains. For serverless developers, the principle of least privilege must extend beyond individual function permissions to consider how functions interact. For cloud providers, IAM systems need serverless-topology-aware reasoning, not just role-level policy evaluation.

Key Takeaways

• Centralized IAM cannot detect cross-function permission chaining in decentralized serverless architectures
• Three attack modalities: direct intra-account, indirect intra-account, and cross-account via shared resources
• 28 risky applications identified across major cloud vendor repositories; 12 confirmed with CVEs and bounties
• Detection reduces to modality-constrained graph reachability analysis with near-linear scaling
• The architectural mismatch between IAM and serverless execution is intrinsic, not a misconfiguration issue
• Cross-account Lambda layer sharing enables full account compromise from a single compromised function

About the Speaker(s)

Xunqi Liu (presented by Nanzi Yang, postdoc at the University of Minnesota) is the co-first author. The research is a joint work with City University in China. The team has published multiple first-author papers at top security conferences and has received security bounties and CVE assignments from major cloud vendors including Google.