CVE-2024-45037
📋 TL;DR
A vulnerability in AWS Cloud Development Kit (CDK) versions 2.142.0 through 2.148.0 allows authenticated Amazon Cognito users to gain unintended access to protected API resources when using RestApi construct with CognitoUserPoolAuthorizer and authorization scopes. This can lead to unauthorized data disclosure or modification. Only CDK applications using these specific configurations are affected.
💻 Affected Systems
- AWS Cloud Development Kit (CDK)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authenticated users bypass intended authorization scopes and gain full access to protected API resources, potentially leading to data exfiltration, unauthorized modifications, or privilege escalation.
Likely Case
Authenticated users access API endpoints they shouldn't have permission to use, resulting in unauthorized data viewing or limited modification capabilities.
If Mitigated
With proper monitoring and least privilege IAM policies, impact is limited to specific API endpoints rather than broader account compromise.
🎯 Exploit Status
Exploitation requires authenticated Cognito user access and specific CDK configuration. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >=2.148.1
Vendor Advisory: https://github.com/aws/aws-cdk/security/advisories/GHSA-qj85-69xf-2vxq
Restart Required: No
Instructions:
1. Update AWS CDK to version 2.148.1 or newer using npm update -g aws-cdk or your package manager. 2. Re-deploy all affected CDK applications. 3. Verify the new deployment uses the patched version.
🔧 Temporary Workarounds
Temporary API Gateway Configuration
allManually adjust API Gateway authorization settings in AWS Console to enforce proper scopes
🧯 If You Can't Patch
- Review and tighten IAM policies for affected API resources to minimize potential damage
- Implement additional API Gateway request validation and monitoring for unauthorized access patterns
🔍 How to Verify
Check if Vulnerable:
Check if CDK version is between 2.142.0 and 2.148.0 inclusive, and application uses RestApi with CognitoUserPoolAuthorizer and authorization scopesCheck Version:
cdk --versionVerify Fix Applied:
Confirm CDK version is 2.148.1 or newer and re-deployed application shows proper authorization behavior📡 Detection & Monitoring
Log Indicators:
- API Gateway logs showing authenticated users accessing endpoints outside their scopes
- CloudTrail events showing unexpected API method executions
Network Indicators:
- Unusual API request patterns from authenticated users
- Requests to protected endpoints without proper scope headers
SIEM Query:
source="aws.cloudtrail" eventName="ExecuteApi" errorCode="AccessDenied" | stats count by userIdentity.principalId, eventSource, eventName