Aws Cdk Lib
Monthly
Information disclosure in AWS CDK's core library (aws-cdk-lib) before 2.267.0 allows a context-dependent actor to cause files from the build host to be published as a deployed asset through improper symbolic-link resolution during asset bundling. Exploitation is local to the build environment and requires the victim to actually run the bundling/synth step (UI:P) on a directory whose contents the attacker can influence, so a developer or CI pipeline must consume untrusted asset sources for the issue to trigger. No public exploit code or confirmed active exploitation has been identified at time of analysis; the primary risk is unintended disclosure of build-host files (for example credentials or configuration) into a deployed stack. Vendor-released patch: 2.267.0, which changes bundling to throw on external symlinks via SymlinkFollowMode.BLOCK_EXTERNAL.
Information disclosure in AWS CDK's core library (aws-cdk-lib) before 2.267.0 allows a context-dependent actor to cause files from the build host to be published as a deployed asset through improper symbolic-link resolution during asset bundling. Exploitation is local to the build environment and requires the victim to actually run the bundling/synth step (UI:P) on a directory whose contents the attacker can influence, so a developer or CI pipeline must consume untrusted asset sources for the issue to trigger. No public exploit code or confirmed active exploitation has been identified at time of analysis; the primary risk is unintended disclosure of build-host files (for example credentials or configuration) into a deployed stack. Vendor-released patch: 2.267.0, which changes bundling to throw on external symlinks via SymlinkFollowMode.BLOCK_EXTERNAL.