CVE-2019-10777
📋 TL;DR
CVE-2019-10777 is a command injection vulnerability in the aws-lambda npm package where unsanitized user input in config.FunctionName is passed to exec() function, allowing arbitrary command execution. This affects applications using vulnerable versions of aws-lambda to deploy AWS Lambda functions. Attackers can execute commands on the host system with the privileges of the aws-lambda process.
💻 Affected Systems
- aws-lambda npm package
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining shell access and executing arbitrary commands with the privileges of the aws-lambda process, potentially leading to data theft, lateral movement, or complete system takeover.
Likely Case
Remote code execution allowing attackers to deploy malicious Lambda functions, access AWS credentials, or compromise the deployment server.
If Mitigated
Limited impact if proper input validation and sanitization are implemented, restricting attackers to controlled function deployment only.
🎯 Exploit Status
Exploitation requires the ability to control the FunctionName parameter, which typically requires some level of access to the deployment system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.5
Vendor Advisory: https://github.com/serverless/aws-lambda/security/advisories/GHSA-4q6p-66m7-44mh
Restart Required: No
Instructions:
1. Update aws-lambda package to version 1.0.5 or later using 'npm update aws-lambda'. 2. Verify the update with 'npm list aws-lambda'. 3. Test Lambda deployment functionality.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for FunctionName parameter to only allow alphanumeric characters and hyphens.
Restrict User Input
allEnsure FunctionName values are not derived from user-controlled sources without proper sanitization.
🧯 If You Can't Patch
- Implement strict input validation to only allow alphanumeric characters and hyphens in FunctionName parameter
- Run aws-lambda process with minimal privileges and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list aws-lambda' to see if version is below 1.0.5Check Version:
npm list aws-lambda | grep aws-lambdaVerify Fix Applied:
Confirm aws-lambda version is 1.0.5 or higher with 'npm list aws-lambda'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Unexpected Lambda function deployments
- Suspicious shell commands in deployment logs
Network Indicators:
- Unexpected outbound connections from deployment server
- Unusual AWS API calls
SIEM Query:
source="application_logs" AND ("exec(" OR "zipCmd" OR "FunctionName") AND suspicious_pattern