# An Insane Timing Allowed Researchers To Take Over AWS Packages - Threat Wire Source: https://www.youtube.com/watch?v=ZrRfc3mbtt4 Recap page: https://rapidrecap.app/video/ZrRfc3mbtt4 Generated: 2026-01-22T16:43:01.707+00:00 --- ## Quick Overview Wiz researchers discovered a critical timing vulnerability in the AWS CodeBuild service that allowed for the complete takeover of AWS GitHub repositories, including the AWS JavaScript SDK, by exploiting a flaw in the actor ID filter used by the service's web hook filters, leading to the exfiltration of GitHub credentials and the ability to approve malicious builds. **Key Points:** - Wiz researchers found a critical timing vulnerability in AWS CodeBuild allowing for the complete takeover of AWS GitHub repositories, including the AWS JavaScript SDK. - The vulnerability exploited a flaw in web hook filters where actor ID values were not strictly matched, allowing attackers to submit numerical IDs that contained required alphanumeric values. - The exploit allowed attackers to generate a bot account containing an approved user ID value, which could then be used to approve malicious builds and extract GitHub credentials. - AWS resolved the issue within 48 hours of receiving the report by implementing further protections for build processes containing GitHub tokens and auditing other public build environments. - The specific exploit involved generating numeric IDs that contained required actor ID values, which forced exact matches for approval, thus bypassing the filter. - The underlying issue in CodeBuild allowed an attacker to force the use of a specific, approved actor ID value via timing attacks when submitting requests. - The researchers demonstrated this by successfully executing a proof-of-concept that allowed them to approve a malicious build on the AWS JavaScript SDK repository. ![Screenshot at 0:13: The 'THREAT WIRE' title card appears over a technical graphic, signaling the start of the main news segment.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-00-13.jpg) **Context:** This segment of the Threat Wire weekly news roundup covers a significant security finding where researchers from Wiz discovered a critical vulnerability in Amazon Web Services' (AWS) CodeBuild service, which is used for continuous integration and deployment. The vulnerability, dubbed 'CodeBreach,' centered on a timing-based flaw in how the service filtered actor IDs during web hook processing, potentially leading to supply chain compromise of widely used AWS libraries. ## Detailed Analysis The video reports on the 'CodeBreach' vulnerability discovered by Wiz Research in AWS CodeBuild, which allowed for the complete takeover of AWS GitHub repositories, including the core AWS JavaScript SDK. This was achieved by exploiting a timing issue in the actor ID filter applied to web hook requests. If an attacker could precisely time their requests, they could force the system to accept a numeric ID that contained the string of an already approved actor ID, effectively bypassing the filter meant to restrict build approvals to authorized users. The researchers successfully executed a proof-of-concept, generating a bot account with an approved ID, which allowed them to approve a malicious build for the AWS SDK, leading to the exfiltration of GitHub credentials. AWS responded quickly, resolving the issue within 48 hours by adding stronger protections and auditing other environments. The report also briefly shifts to another security story regarding the N8N workflow automation product, which has seen four critical CVEs in two weeks, one of which is a Denial of Service (DoS) vulnerability rated 7.5/10 CVSS, caused by improper handling of asynchronous hook callbacks that leads to stack space exhaustion and a fatal hook error. ### AWS CodeBuild Vulnerability (CodeBreach) - Exploit involved timing attacks on actor ID filters - Allowed complete takeover of AWS GitHub repositories including AWS JavaScript SDK - Attackers could extract GitHub credentials and approve malicious builds - AWS patched the issue within 48 hours of the report. ### N8N Security Update - N8N ecosystem hit with four critical CVEs in two weeks - One vulnerability is a DoS flaw (CVSS 7.5) caused by improper handling of async hook callbacks - This leads to stack space exhaustion and a fatal runtime error if recursion is involved. ### Mandiant's NTLMv1 Rainbow Table Release - Mandiant released a comprehensive dataset of Net-NTLMv1 hashes to accelerate the deprecation of the insecure protocol - Rainbow tables allow cracking hashes in under 12 hours for consumer hardware - The release aims to lower the barrier for security professionals to demonstrate the protocol's insecurity. ![Screenshot at 0:11: The video transitions to a visual representation of a satellite map view being actively searched by a red targeting reticle, symbolizing the targeting of AWS infrastructure.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-00-11.jpg) ![Screenshot at 0:52: A screenshot of the Wiz Research blog post titled 'CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild' detailing the vulnerability.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-00-52.jpg) ![Screenshot at 3:13: A grayscale satellite image overlaid with text quoting AWS's statement that no other actor took advantage of the regex issue.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-03-13.jpg) ![Screenshot at 4:07: A screenshot of the Endor Labs blog post detailing the ongoing N8N supply chain attack campaign called 'n8mare' targeting the n8n ecosystem.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-04-07.jpg) ![Screenshot at 5:21: A screenshot of the Mandiant blog post titled 'Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation,' explaining their move to deprecate the old authentication protocol.](https://ss.rapidrecap.app/screens/ZrRfc3mbtt4/00-05-21.jpg)