PT-2023-31713 · Unknown · Sandbox Accounts For Events

Mahmoud0X00 · Publicado 2023-12-22 · Atualizado 2024-01-08 · CVE-2023-50928

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sandbox Accounts for Events versions prior to 1.1.0

Description The issue allows authenticated users to potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, and it is not possible to access AWS accounts in use or existing data/infrastructure.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the account API to minimize the risk of exploitation. Avoid using the API to claim empty AWS accounts with non-existent event ids until the issue is resolved.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-50928

GHSA-CG8W-7Q5V-G32R

Produtos afetados

Sandbox Accounts For Events

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50928.json · Exploit
• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79 · Correção
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r · Nota
• https://osv.dev/vulnerability/CVE-2023-50928 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50928 · Nota de Segurança
• https://twitter.com/cracbot/status/1738624152800502045 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1738306727475286436 · Publicação no Twitter
• https://t.me/cvenotify/66608 · Publicação no Telegram