Api Lambda Send Email Ses
Monthly
Unauthenticated access to the AWS API Gateway endpoint in simalexan/api-lambda-send-email-ses allows any remote attacker to invoke the SES.sendEmail Lambda function without credentials, abusing the deployer's AWS Simple Email Service account to send arbitrary emails. Affected deployments are those built from any commit up to bda6869aa81371d1e872242e74fe7d953edb818d, with no patched release available as the project uses rolling delivery and the maintainer has not responded to the disclosure. No public exploit code or CISA KEV listing exists, but exploitation requires only knowledge of the deployed API Gateway URL and a simple HTTP request.
Unauthenticated access to the AWS API Gateway endpoint in simalexan/api-lambda-send-email-ses allows any remote attacker to invoke the SES.sendEmail Lambda function without credentials, abusing the deployer's AWS Simple Email Service account to send arbitrary emails. Affected deployments are those built from any commit up to bda6869aa81371d1e872242e74fe7d953edb818d, with no patched release available as the project uses rolling delivery and the maintainer has not responded to the disclosure. No public exploit code or CISA KEV listing exists, but exploitation requires only knowledge of the deployed API Gateway URL and a simple HTTP request.