Amazon VEWで任意コード実行の脆弱性、修正版あり
Summary
Amazon Virtual Engineering Workbench（VEW）の公開コンポーネントに、認証済みの利用者が任意のコードを実行できる脆弱性があります。VEWを構築している組織は、最新版から再デプロイしてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Amazon Virtual Engineering Workbench（VEW）の公開コンポーネントに、認証済みの利用者が任意のコードを実行できる脆弱性があります。VEWを構築している組織は、最新版から再デプロイしてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| AWS | virtual-engineering-workbench |
< c146486cec41f5b04fae57e9ce1a7fb40e695615 |
c146486cec41f5b04fae57e9ce1a7fb40e695615 |
Original description The description as published by the source.
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.
To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory aws.amazon.com
- AWS aws.amazon.com
- web github.com
- web nvd.nist.gov
- web aws.amazon.com
- web github.com