Executive brief
Amazon Connect Salesforce Lambda is a serverless integration tool that links Amazon Connect (a customer contact center platform) with Salesforce CRM. The sfExecuteAWSService Lambda function has a flaw that allows users with permission to invoke the function to perform AWS operations they would normally be denied, potentially accessing customer data, modifying resources, or disrupting operations.
Technical details
The vulnerability is a missing authorization check in the sfExecuteAWSService Lambda function within the Amazon Connect Salesforce Lambda Serverless Application Repository application. The function accepts caller-supplied parameters that are directly dispatched to privileged AWS service APIs without validating whether the caller is authorized to perform those operations. An attacker with IAM permissions to invoke this Lambda function (lambda:InvokeFunction) can craft parameters to execute AWS service operations that exceed their own IAM permissions, resulting in privilege escalation. The function is designed for initial setup scenarios but fails to enforce proper authorization controls. Affected versions are 5.15 through 5.24.16. A patch or updated version should be applied to add proper authorization validation before invoking AWS service APIs.
Affected products
- Amazon Connect Salesforce Lambda 5.15 to 5.24.16
Timeline
- 2026-09-22: disclosed