Secrets Replicator
Monthly
Cross-account secret replication in devopspolis secrets-replicator up to and including 0.4.0 silently drops the configured External ID, so the confused-deputy safeguard that operators believe protects the destination role is never actually enforced. An attacker who already holds or can influence an AWS principal that is permitted to assume the destination role (CVSS PR:L, requiring some standing in the trust relationship) can therefore assume it without supplying the External ID, resulting in incorrect permission assignment and limited confidentiality and integrity impact (CVSS 5.3, CWE-732). The flaw affects only deployments that use cross-account AssumeRole replication and rely on external_id for isolation; single-account deployments and configurations that never used an External ID are not impacted. Patches ship in v0.5.0 (commit b42239405fbf4fae3c3f0048fc0b4225112edceb) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-account secret replication in devopspolis secrets-replicator up to and including 0.4.0 silently drops the configured External ID, so the confused-deputy safeguard that operators believe protects the destination role is never actually enforced. An attacker who already holds or can influence an AWS principal that is permitted to assume the destination role (CVSS PR:L, requiring some standing in the trust relationship) can therefore assume it without supplying the External ID, resulting in incorrect permission assignment and limited confidentiality and integrity impact (CVSS 5.3, CWE-732). The flaw affects only deployments that use cross-account AssumeRole replication and rely on external_id for isolation; single-account deployments and configurations that never used an External ID are not impacted. Patches ship in v0.5.0 (commit b42239405fbf4fae3c3f0048fc0b4225112edceb) and no public exploit code or confirmed active exploitation has been identified at time of analysis.