Wiz Details CodeBreach CI Flaw That Enabled Takeover of AWS GitHub Repositories
Summary
Wiz researchers say an unanchored CodeBuild filter let them bypass trusted-user checks, steal a GitHub token, and gain admin access to AWS repositories. AWS remediated the issue and says it found no customer or service impact.
Key points
- Unanchored regex filters in four AWS-owned CodeBuild projects allowed GitHub user IDs containing trusted maintainer IDs to pass actor checks.
- Researchers automated GitHub App bot creation to obtain a matching ID, then used a pull request to trigger a privileged build.
- A payload dumped process memory to retrieve the CodeBuild project's GitHub credentials; the token provided repository administrator access.
- The researchers said the access could have enabled malicious code injection into AWS JavaScript SDK releases and affected related repositories.
- Wiz disclosed the issue to AWS. AWS anchored the filters, revoked the token, added memory protections, and audited public build environments.
- AWS said it found no evidence that another actor exploited the flaw and determined there was no impact to customer environments or AWS services.
- Wiz recommends preventing untrusted pull requests from triggering privileged builds, using build approval gates, and limiting integration-token permissions.
Article Details
- Attack Vectors
- Unanchored ACTOR_ID regular-expression filters let a newly registered GitHub bot account with an ID containing an approved maintainer ID trigger a privileged CodeBuild build from an untrusted pull request.
- A malicious NPM dependency in the pull request ran in the build environment and dumped process memory to obtain the GitHub token.
- The obtained token's repository permissions were used to add an attacker-controlled GitHub user as a repository administrator, enabling direct code pushes, pull-request approvals, and access to repository secrets.
- Defensive Notes
- Enable the Pull Request Comment Approval build gate, or use CodeBuild-hosted runners with GitHub workflows to manage build triggers.
- If using webhook filters, anchor regular expressions with start and end markers so they require an exact match.
- Use a unique, fine-grained Personal Access Token for each CodeBuild project and restrict it to the minimum required permissions; consider a dedicated unprivileged GitHub account.
- Prevent untrusted pull requests from triggering privileged builds, and reduce pipeline privileges.
- AWS reported anchoring the vulnerable filters, revoking the exposed token, adding protections for build processes containing credentials in memory, and auditing public build environments and logs.
MITRE ATT&CK
T1003.007 · Proc FilesystemThe payload dumped process memory in the build environment to retrieve the GitHub token.T1059.007 · JavaScriptA malicious NPM dependency submitted in a pull request executed code in the CodeBuild environment.T1078.004 · Cloud AccountsThe attack used a newly registered GitHub bot account whose numeric ID bypassed the repository's ACTOR_ID filter.T1098.002 · Additional Email Delegate PermissionsUsing the stolen token's repository scope, the researchers added their GitHub user as a repository administrator.T1195.001 · Compromise Software Dependencies and Development ToolsThe researchers demonstrated how control of a privileged build and repository could enable malicious code insertion into the AWS JavaScript SDK release supply chain.T1567 · Exfiltration Over Web ServiceThe article says repository secrets could be exfiltrated after administrator access; it does not describe a completed exfiltration.
People
Hillai Ben-SassonNamed member of the Wiz Research team that reported and demonstrated CodeBreach.Nir OhfeldNamed member of the Wiz Research team that reported and demonstrated CodeBreach.Ronen ShustinNamed member of the Wiz Research team that reported and demonstrated CodeBreach.Sagi TzadikNamed member of the Wiz Research team that reported and demonstrated CodeBreach.Yuval AvrahamiNamed member of the Wiz Research team that reported and demonstrated CodeBreach.
Vendors
Products
Amazon Q VS Code extensionactor abused a similar CodeBuild issue to launch a supply chain attack against users of the Amazon Q VS Code extension. This growing trend underscores the urgent need for organizations to harden their CI/CDAWS CodeBuildThe vulnerability stemmed from a subtle flaw in how the repositories’ AWS CodeBuild CI pipelines handled build triggers. Just two missing characters in a Regex filter allowed unauthenticated attackers to infiltrate theAWS JavaScript SDKThe issue allowed a complete takeover of key AWS GitHub repositories - most notably the AWS JavaScript SDK, a core library that powers the AWS Console.AWS Management ConsoleWiz Research uncovered CodeBreach, a critical vulnerability that placed the AWS Console supply chain at risk.npmpreparing a pull request that fixes a legitimate issue. Buried within the PR was the real payload: a new NPM package dependency designed to execute in the build environment and extract the GitHub credentials.