An Insane Timing Allowed Researchers To Take Over AWS Packages - Threat Wire

Quick Overview

Wiz researchers discovered a critical timing vulnerability in the AWS CodeBuild service that allowed for the complete takeover of AWS GitHub repositories, including the AWS JavaScript SDK, by exploiting a flaw in the actor ID filter used by the service's web hook filters, leading to the exfiltration of GitHub credentials and the ability to approve malicious builds.

Key Points: Wiz researchers found a critical timing vulnerability in AWS CodeBuild allowing for the complete takeover of AWS GitHub repositories, including the AWS JavaScript SDK. The vulnerability exploited a flaw in web hook filters where actor ID values were not strictly matched, allowing attackers to submit numerical IDs that contained required alphanumeric values. The exploit allowed attackers to generate a bot account containing an approved user ID value, which could then be used to approve malicious builds and extract GitHub credentials. AWS resolved the issue within 48 hours of receiving the report by implementing further protections for build processes containing GitHub tokens and auditing other public build environments. The specific exploit involved generating numeric IDs that contained required actor ID values, which forced exact matches for approval, thus bypassing the filter. The underlying issue in CodeBuild allowed an attacker to force the use of a specific, approved actor ID value via timing attacks when submitting requests. The researchers demonstrated this by successfully executing a proof-of-concept that allowed them to approve a malicious build on the AWS JavaScript SDK repository.

Context: This segment of the Threat Wire weekly news roundup covers a significant security finding where researchers from Wiz discovered a critical vulnerability in Amazon Web Services' (AWS) CodeBuild service, which is used for continuous integration and deployment. The vulnerability, dubbed 'CodeBreach,' centered on a timing-based flaw in how the service filtered actor IDs during web hook processing, potentially leading to supply chain compromise of widely used AWS libraries.