Aws Security Agent Plugin
Monthly
Bucket-squatting in the AWS Security Agent Plugin (aws-agents-for-devsecops) before 1.1.0 allows a remote unauthenticated attacker to intercept private workspace source archives uploaded during security scans. Because the S3 bucket name is deterministically derived from the victim's AWS account ID and region - both non-secret and frequently exposed in public ARNs, IAM policy documents, and ECR URIs - a third party can pre-register the predictable name in their own AWS account before the victim's setup runs. When a scan is subsequently triggered, the unpatched plugin uploads source.zip (containing source code, credentials, and infrastructure state) to the attacker-controlled bucket without verifying ownership, silently exfiltrating sensitive data. Vendor-released patch: 1.1.0.
Bucket-squatting in the AWS Security Agent Plugin (aws-agents-for-devsecops) before 1.1.0 allows a remote unauthenticated attacker to intercept private workspace source archives uploaded during security scans. Because the S3 bucket name is deterministically derived from the victim's AWS account ID and region - both non-secret and frequently exposed in public ARNs, IAM policy documents, and ECR URIs - a third party can pre-register the predictable name in their own AWS account before the victim's setup runs. When a scan is subsequently triggered, the unpatched plugin uploads source.zip (containing source code, credentials, and infrastructure state) to the attacker-controlled bucket without verifying ownership, silently exfiltrating sensitive data. Vendor-released patch: 1.1.0.