Aws Cdk Aws Redshift Alpha
Monthly
SQL injection in the @aws-cdk/aws-redshift-alpha database-query custom resource handlers, affecting versions before 2.274.0-alpha.0, lets an actor who can influence construct property values - specifically the user name, comment, or password fields - execute arbitrary SQL against Amazon Redshift with superuser privileges, including granting access to all cluster users. The assessed vector is local with low privileges and required user interaction: a CDK stack deployment must actually run with the attacker-influenced values, so this is not remotely reachable against a running service and deployments built only from trusted, static property values are not realistically exposed. AWS has released 2.274.0-alpha.0 to address the flaw, and no public exploit code has been identified at time of analysis.
SQL injection in the @aws-cdk/aws-redshift-alpha database-query custom resource handlers, affecting versions before 2.274.0-alpha.0, lets an actor who can influence construct property values - specifically the user name, comment, or password fields - execute arbitrary SQL against Amazon Redshift with superuser privileges, including granting access to all cluster users. The assessed vector is local with low privileges and required user interaction: a CDK stack deployment must actually run with the attacker-influenced values, so this is not remotely reachable against a running service and deployments built only from trusted, static property values are not realistically exposed. AWS has released 2.274.0-alpha.0 to address the flaw, and no public exploit code has been identified at time of analysis.