Virtual Engineering Workbench
Monthly
Improper neutralization of template-engine syntax in the publishing component of Amazon Virtual Engineering Workbench (VEW) lets a remote low-privileged authenticated third party run arbitrary code under the publishing Lambda's IAM role by submitting a crafted CloudFormation template body through the product versioning API. Because that role can reach resources across tenant projects, successful exploitation ranges from code execution to cross-tenant data and resource access, and AWS rates the issue at CVSS 9.4 (CWE-1336). No public exploit code has been identified at time of analysis; the vendor has published an upstream fix and directs users to redeploy from the latest awslabs/virtual-engineering-workbench release.
Improper neutralization of template-engine syntax in the publishing component of Amazon Virtual Engineering Workbench (VEW) lets a remote low-privileged authenticated third party run arbitrary code under the publishing Lambda's IAM role by submitting a crafted CloudFormation template body through the product versioning API. Because that role can reach resources across tenant projects, successful exploitation ranges from code execution to cross-tenant data and resource access, and AWS rates the issue at CVSS 9.4 (CWE-1336). No public exploit code has been identified at time of analysis; the vendor has published an upstream fix and directs users to redeploy from the latest awslabs/virtual-engineering-workbench release.