Amazon Connect Salesforce Lambda
Monthly
Privilege escalation in Amazon's amazon-connect-salesforce-lambda integration (all versions before 5.26) allows any authenticated AWS IAM principal that already holds lambda:InvokeFunction permission on the sfExecuteAWSService function to invoke it with caller-supplied service and API parameters, causing the function's own privileged execution role to perform AWS API operations that the caller's own identity is explicitly denied (CVSS 3.1: 8.1 High, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; CWE-862 Missing Authorization). This is a confused-deputy flaw: it requires a pre-existing authenticated AWS foothold with invoke rights, cannot be reached anonymously, and needs no user interaction, and it only affects organizations that have deployed this specific Salesforce CTI integration. No public exploit code has been identified at time of analysis and there is no KEV listing; the vendor-released fix is v5.26, which introduces a SalesforceExecuteAWSServiceUser parameter to restrict who may invoke the function.
Privilege escalation in Amazon's amazon-connect-salesforce-lambda integration (all versions before 5.26) allows any authenticated AWS IAM principal that already holds lambda:InvokeFunction permission on the sfExecuteAWSService function to invoke it with caller-supplied service and API parameters, causing the function's own privileged execution role to perform AWS API operations that the caller's own identity is explicitly denied (CVSS 3.1: 8.1 High, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; CWE-862 Missing Authorization). This is a confused-deputy flaw: it requires a pre-existing authenticated AWS foothold with invoke rights, cannot be reached anonymously, and needs no user interaction, and it only affects organizations that have deployed this specific Salesforce CTI integration. No public exploit code has been identified at time of analysis and there is no KEV listing; the vendor-released fix is v5.26, which introduces a SalesforceExecuteAWSServiceUser parameter to restrict who may invoke the function.