Executive brief
AWS Amplify CLI is a development tool used to build and deploy cloud applications on AWS. A flaw in how it manages AWS identity and access control policies could allow unauthorized actors to assume elevated roles in AWS after an authorized developer removes the authentication component from a project. This could lead to unauthorized access to sensitive AWS resources and data.
Technical details
The vulnerability involves incorrect IAM role trust policy management in AWS Amplify CLI versions before 12.10.1. When an authorized user removes the Authentication component from an Amplify project, the CLI deletes a Condition property from the trust policy statement but leaves the "Effect":"Allow" intact. This permits sts:AssumeRoleWithWebIdentity to be invoked by any principal (CWE-269, CWE-276 - improper access control and incorrect default permissions). The attack requires that an authorized AWS user perform the Authentication component removal; however, this is a realistic scenario if an organization wants to migrate identity providers. The vulnerability was fixed by changing the policy effect to "Deny" instead of leaving it as "Allow" when removing the component. Projects affected are those that used the feature between August 2019 and January 2024 and subsequently removed authentication.
Affected products
- AWS Amplify CLI before 12.10.1
Timeline
- 2024-04-15: disclosed
- 2024-04-15: patched: Fixed in version 12.10.1