CodeBreach: a CodeBuild misconfiguration exposed AWS repositories

Researchers at Wiz have described a critical supply chain vulnerability, dubbed CodeBreach, in which a CodeBuild misconfiguration could be abused to take over key AWS repositories on GitHub. The flaw lay in a regular expression meant to restrict CI builds to approved users but which was not properly anchored. Wiz obtained administrative privileges on the AWS SDK for JavaScript repository, which the researchers note is used in two-thirds of cloud environments. AWS has mitigated the attack vector, and Wiz recommends reviewing the required actions section of its publication.

What this means for your organisation

In the worst case this could have enabled a supply chain attack comparable to SolarWinds in 2020. The lesson for organisations is not this single, now-fixed flaw, but that the build chain is an attack surface on par with production. An unanchored regular expression is a small mistake with wide reach when it governs who may run builds.

Berigo recommends

• Review who and what can trigger builds in your own CI pipelines, and what privileges those jobs hold.
• Pay particular attention to access rules based on pattern matching, and verify the expressions are anchored.
• Follow the recommended actions from Wiz and the AWS security bulletin.
• Treat the build environment as a production system with equivalent logging and access controls.

Source

• wiz.io
• aws.amazon.com