Lucene search

K
cve[email protected]CVE-2023-35165
HistoryJun 23, 2023 - 9:15 p.m.

CVE-2023-35165

2023-06-2321:15:09
CWE-863
web.nvd.nist.gov
125
aws
cdk
security
eks
roles
vulnerability
fix
trust policy

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.9%

AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster constructs create two roles, CreationRole and default MastersRole, that have an overly permissive trust policy.

The first, referred to as the CreationRole, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g KubernetesManifest, HelmChart, …) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected.

The second, referred to as the default MastersRole, is provisioned only if the mastersRole property isn’t provided and has permissions to execute kubectl commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected.

The issue has been fixed in @aws-cdk/aws-eks v1.202.0 and aws-cdk-lib v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. There is no workaround available for CreationRole. To avoid creating the default MastersRole, use the mastersRole property to explicitly provide a role.

Affected configurations

Vulners
NVD
Node
awsaws_cdkRange2.0.02.80.0
OR
awsaws_cdkRange1.57.01.202.0

CNA Affected

[
  {
    "vendor": "aws",
    "product": "aws-cdk",
    "versions": [
      {
        "version": "aws-cdk-lib >= 2.0.0, < 2.80.0",
        "status": "affected"
      },
      {
        "version": "@aws-cdk/aws-eks >= 1.57.0, < 1.202.0",
        "status": "affected"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.9%

Related for CVE-2023-35165