Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-45037— AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template

Quick assessment

Affected
aws aws-cdk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AWS Cloud Development Kit是Amazon Web Services开源的一个开源软件开发框架，用于在代码中定义云基础设施并通过 AWS CloudFormation 进行配置。 AWS Cloud Development Kit存在安全漏洞，该漏洞源于经过身份验证的 Cognito 用户可能会意外访问受保护的 API 资源或方法，从而导致潜在的数据泄露和修改问题。

CVSS 6.4 · Medium EPSS 0.31% · P22
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-45037

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template
Source: CVE Program / CVE List V5
Vulnerability Description
The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates. We identified an issue in AWS Cloud Development Kit (CDK) which, under certain conditions, can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access. This issue does not affect the availability of the specific API resources. Authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure, and modification issues. Impacted versions: >=2.142.0;<=2.148.0. A patch is included in CDK versions >=2.148.1. Users are advised to upgrade their AWS CDK version to 2.148.1 or newer and re-deploy their application(s) to address this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
AWS Cloud Development Kit 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AWS Cloud Development Kit是Amazon Web Services开源的一个开源软件开发框架，用于在代码中定义云基础设施并通过 AWS CloudFormation 进行配置。 AWS Cloud Development Kit存在安全漏洞，该漏洞源于经过身份验证的 Cognito 用户可能会意外访问受保护的 API 资源或方法，从而导致潜在的数据泄露和修改问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
aws aws-cdk >= 2.142.0, < 2.148.1 -

II. Public POCs for CVE-2024-45037

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-45037

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-45037 (1)

Vendor Advisories for CVE-2024-45037 (1)

Vendor Pages for CVE-2024-45037 (1)

IV. Related Vulnerabilities

Same product: aws-cdk
Same vendor: aws
Same weakness: CWE-863

V. Comments for CVE-2024-45037

No comments yet

Leave a comment