by Kastro
Paper/Archive/CVE-2023-50928

CVE-2023-50928

awslabs sandbox-accounts-for-events — sandbox-accounts-for-events security misconfiguration leads to budget exceed

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (NVD)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 31.6.316 × 206.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.

Affected

ProductAffectedFixed inSource
sandbox-accounts-for-events< 1.1.0–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
GitHub_M (CNA)7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

References

refgithub.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32rrefgithub.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79