Executive brief
AWS CodeBuild, a service used to automate software building and testing, was found to have a vulnerability that allows attackers to steal sensitive access tokens. By submitting a malicious pull request to a repository that uses automated builds, an attacker can extract credentials from the build environment's memory. If these stolen tokens have write permissions, the attacker could modify the organization's source code, potentially leading to supply chain attacks or unauthorized software changes.
Technical details
A vulnerability in AWS CodeBuild allows for the extraction of source code repository access tokens (e.g., GitHub, BitBucket, GitLab) via memory dumps within the build environment. The attack is triggered when a threat actor submits a Pull Request (PR) that is automatically executed by a CodeBuild process. If the build environment contains credentials with write access, the attacker can leverage the extracted tokens to commit unauthorized code to the repository. AWS has implemented additional protections for builds using unprivileged mode and recommends disabling automatic builds for untrusted PRs or using self-hosted GitHub Actions runners in CodeBuild, which are not affected.
Affected products
- AWS CodeBuild All regions
Timeline
- 2025-07-25: disclosed: Initial publication date
- 2025-08-12: advisory: Updated advisory publication