PT-2024-22240 · Amazon · Amazon Aws Amplify Cli

Nick Frichette · Published 2024-04-15 · Updated 2025-06-30 · CVE-2024-28056

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon AWS Amplify CLI versions prior to 12.10.1

Description The issue arises when the Authentication component is removed from an Amplify project, resulting in the removal of a Condition property but leaving "Effect":"Allow" present. This allows sts:AssumeRoleWithWebIdentity to be available to threat actors with no conditions, potentially leading to unauthorized access to an organization's AWS resources. The problem can only occur if an authorized AWS user removes an Authentication component, which may happen in realistic situations such as stopping the use of built-in Cognito resources or moving to a different identity provider.

Recommendations For Amazon AWS Amplify CLI versions prior to 12.10.1, upgrade to version 12.10.1 or later to mitigate the risk. As a temporary workaround, consider restricting access to the affected IAM roles until the issue is resolved. Avoid removing the Authentication component from Amplify projects unless necessary, and ensure that all changes are made by authorized AWS users.

Exploit

Fix

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

CVE-2024-28056

GHSA-846G-P7HM-F54R

Affected Products

Amazon Aws Amplify Cli

References · 17

• 🔥 https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json · Exploit
• 🔥 https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover · Exploit
• https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-28056 · Security Note
• https://osv.dev/vulnerability/GHSA-846g-p7hm-f54r · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2024-003 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28056 · Vendor Advisory
• https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1 · Note
• https://github.com/aws-amplify/amplify-cli · Note
• https://twitter.com/LogicataCloud/status/1780596036115058915 · Twitter Post
• https://twitter.com/eyalestrin/status/1780107165346517356 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1779980597101801973 · Twitter Post
• https://t.me/cvenotify/127110 · Telegram Post
• https://t.me/cvenotify/90793 · Telegram Post
• https://twitter.com/HackingthCloud/status/1843652718465839552 · Twitter Post