Aws Sam Cli
Monthly
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.