AWS fixes cloud development kit security flaw that could allow for complete account takeover

Amazon Web Services (AWS) has fixed a security flaw in its Cloud Development Kit (CDK) which could have allowed threat actors to fully take over people’s accounts.

The AWS Cloud Development Kit (CDK) is an open source software development framework that allows developers to define cloud infrastructure using familiar programming languages like TypeScript, Python, and Java. It simplifies the process of creating and managing AWS resources by converting code into AWS CloudFormation templates, enabling infrastructure as code (IaC) practices.

In order to deploy an app, users are first required to bootstrap the environment, which includes creating necessary components such as identity and access management (IAM) ropes, permissions, policies, and an S3 staging bucket. The S3 staging buckets follow the same naming pattern: “cdk-{Qualifier}-{Description}-{Account-ID}-{Region}”. That means, crooks can easily predict the name, as long as they know the AWS Account-ID, and the region in which the CDK is deployed.

Thousands of instances

“Since the Prefix is always cdk, the Qualifier is by default hnb659fds, and assets is a constant string in the bucket name, the only variables that change are the Account ID and the Region,” explained cybersecurity researchers from Aqua, who first spotted the flaw.

This means crooks could claim someone else’s CDK staging bucket name in advance, preload it with malware, and then just wait for the victim to run it.

To make matters worse, Aqua says there are “thousands” of instances with the default qualifier being used in the bootstrap process, making it super easy to claim another user’s CDK staging bucket name. In fact, the problem could “allow an attacker to gain administrative access to a target AWS account, resulting in a full account takeover,” the pros explained.

Aqua reported the flaw to Amazon, who patched it in early July this year, it was said. The first clean CDK version is v2.149.0.

Via The Register