AWS CICD-toolchain-for-serverless-applications Incorrect Privilege Assignment LPE Vulnerability Summary

Vulnerability Summary for AWS CICD-toolchain-for-serverless-applications Vulnerability Overview Vulnerability Name: Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications Description: Prior to version 1.0.11, the CloudFormation deployment role provided by CICD-toolchain-for-serverless-applications was granted overly broad permissions, allowing users with AWS account access to access or modify application code outside the application source repository. Affected Scope: Versions < 1.0.11. Remediation: Upgrade to version 1.0.11 or higher. Affected Scope Affected Versions: < 1.0.11 Fixed Version: 1.0.11 CVSS Score: 8.1 / 10 (High) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Confidentiality Impact: Undefined Integrity Impact: High Availability Impact: High Remediation Fix Link: https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11 POC or Exploit Code No specific POC or exploit code is included in the page. Proof of Concept Proof of Concept: An attacker with access to the application repository can create an application template that references IAM roles, Secrets Manager keys, or S3 object parameters. When the pipeline deploys this template, the CloudFormation deployment role allows operations on external resources prior to version 1.0.11. Impact Impact: Incorrect permission assignments in IAM roles allow remote attackers to exploit vulnerabilities in AWS CICD-toolchain-for-serverless-applications versions prior to 1.0.11, performing privilege escalation and accessing or modifying resources outside the application source repository of the deployment toolchain. The impact is limited to the account hosting the deployment toolchain, with no cross-account or cross-customer impact.

Goal Reached Thanks to every supporter — we hit 100%!

AWS CICD-toolchain-for-serverless-applications Incorrect Privilege Assignment LPE Vulnerability Summary

More from this source