Executive brief
QnABot on AWS is an open-source conversational interface that allows organizations to build chatbots using Amazon's AI services. A security vulnerability was found where an authorized administrator could bypass security restrictions to execute unauthorized code on the underlying server. This could allow an attacker to gain direct access to sensitive backend data, including database records, search indices, and private files stored in S3, which are normally protected from administrative access.
Technical details
A sandbox bypass vulnerability exists in QnABot on AWS due to the improper use of the 'static-eval' npm package. An authenticated administrator can exploit this by injecting a crafted conditional chaining expression through the Content Designer interface, utilizing JavaScript prototype manipulation to escape the intended expression sandbox. Successful exploitation allows for arbitrary code execution within the fulfillment Lambda execution context. This grants the attacker access to the Lambda's environment variables and associated AWS resources such as S3, DynamoDB, and OpenSearch. The issue is resolved in version 7.3.0 by replacing 'static-eval' with a custom, limited expression evaluator.
Affected products
- AWS QnABot on AWS <=7.2.4
Timeline
- 2026-04-27: disclosed
- 2026-04-27: advisory
- 2026-04-27: patched: Fixed in version 7.3.0