PT-2024-27450 · Amazon · Aws-Deployment-Framework
Zolaer9527
·
Published
2024-06-11
·
Updated
2024-08-16
·
CVE-2024-37293
CVSS v3.1
7.5
High
| Vector | AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
aws-deployment-framework versions prior to 4.0.0
Description
The AWS Deployment Framework (ADF) contains a bootstrap process that relies on elevated privileges to deploy ADF's bootstrap stacks, facilitating multi-account cross-region deployments. Prior to version 4.0.0, the bootstrap CodeBuild role provides access to the
sts:AssumeRole operation without further restrictions, allowing it to assume into any AWS Account in the AWS Organization with elevated privileges. This issue can be exploited by an actor with permissions to change the behavior of the CodeBuild project or the Lambda function, enabling them to escalate their privileges.Recommendations
As a temporary mitigation, add a permissions boundary to the roles created by ADF in the management account. The permissions boundary should deny all IAM and STS actions. This permissions boundary should be in place until you upgrade ADF or bootstrap a new account.
Upgrade to
aws-deployment-framework version 4.0.0 to resolve the issue.Exploit
Fix
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aws-Deployment-Framework