Harmonix
Monthly
Privilege escalation in Harmonix on AWS framework deployments v0.3.0 through v0.4.1 allows an authenticated IAM principal within the same AWS account to assume an overly-permissive EKS environment provisioning role with administrative privileges, due to the default trust policy granting sts:AssumeRole to the account root principal. Exploitation is limited to in-account actors who already possess sts:AssumeRole permission, and does not affect versions v0.4.2 or later or hardened configurations; no public exploit identified at time of analysis. Vendor-released patch: Harmonix on AWS v0.4.2.
Privilege escalation in Harmonix on AWS framework deployments v0.3.0 through v0.4.1 allows an authenticated IAM principal within the same AWS account to assume an overly-permissive EKS environment provisioning role with administrative privileges, due to the default trust policy granting sts:AssumeRole to the account root principal. Exploitation is limited to in-account actors who already possess sts:AssumeRole permission, and does not affect versions v0.4.2 or later or hardened configurations; no public exploit identified at time of analysis. Vendor-released patch: Harmonix on AWS v0.4.2.