Virtual Engineering Workbench publishing component template injection
Logged-in users of a dev environment tool could hack other projects' data.
Summary
Virtual Engineering Workbench, an open-source platform for publishing development environments, has a template injection flaw in its publishing component. An authenticated user can run arbitrary code with the publishing Lambda's IAM role and reach data across all tenant projects.
Affected when
- an authenticated user who can create or update product versions
What to do
Redeploy from the latest version of the main branch (commit c146486 or later). Until then, limit which users can create or update product versions. No workaround removes the issue.
Products and platforms
CVE IDs
Sources
- Advisory: aws.amazon.com (opens in a new tab)
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen