Harmonix on AWS CVE-2025-14503

Requires that the Harmonix on AWS framework was deployed using versions v0.3.0 through v0.4.1 with the sample EKS environment provisioning role left at its default trust configuration, which grants sts:AssumeRole to the account root principal (iam.AccountRootPrincipal). The attacker must already be an authenticated IAM principal within the same AWS account and must possess sts:AssumeRole permission. Exploitation is LIMITED to in-account actors (no cross-account or internet-facing path), does not apply to accounts that deployed v0.4.2+ or that hardened the role's trust policy, and requires that the vulnerable EKS provisioning role actually exist in the account.

This is a genuine but conditionally-gated privilege-escalation issue (CWE-266), not a drive-by remote flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) correctly reflects that full confidentiality/integrity/availability impact is reachable with low attack complexity and no user interaction, but PR:H confirms the attacker must already hold a credentialed IAM principal inside the same AWS account. The high base score therefore represents post-foothold lateral movement / insider escalation rather than external compromise - the kill-chain prerequisite (valid in-account credentials with sts:AssumeRole) materially lowers real-world urgency versus an unauthenticated RCE of the same score. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit was provided (the GitHub PR #189 link is the vendor FIX, not weaponized exploit code), so there is no evidence of active or at-scale exploitation. One discrepancy to verify: the vendor rated PR:H, but the description says 'any IAM principal in the same account with sts:AssumeRole permissions' can escalate - that is arguably a low-privilege bar (PR:L), which would raise the score; treat the privilege prerequisite as low-to-moderate rather than strictly high. Net: a real priority for the specific population that deployed the affected sample code, but low broad-exploitation risk given the in-account authentication gate and niche product footprint.

An attacker who has already gained any low-privilege IAM identity in the AWS account (e.g. via a compromised developer key or a limited-permission workload) with sts:AssumeRole permission calls STS to assume the Harmonix EKS environment provisioning role, which was sample-configured to trust the account root principal. The role carries administrative provisioning privileges, so the attacker instantly escalates from limited access to admin over the environment. No public exploit code was provided; exploitation uses only standard AWS STS API calls.