CVE-2025-2598
📋 TL;DR
The AWS CDK CLI prints AWS credentials to console output when used with credential plugins that return expiration properties. This exposes sensitive credentials to anyone with access to console logs. Users of AWS CDK CLI with credential plugins are affected.
💻 Affected Systems
- AWS Cloud Development Kit (AWS CDK) Command Line Interface
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
AWS credentials are captured from console logs, leading to unauthorized access to AWS resources, data exfiltration, or resource hijacking.
Likely Case
Credentials exposed in development or CI/CD logs, potentially compromising AWS accounts if logs are not properly secured.
If Mitigated
Minimal impact if proper credential management and log security controls are in place.
🎯 Exploit Status
Exploitation requires access to console logs where AWS CDK CLI output is captured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.178.2 or later
Vendor Advisory: https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp
Restart Required: No
Instructions:
1. Update AWS CDK CLI using npm: 'npm update -g aws-cdk' 2. Verify version with 'cdk --version' 3. Ensure version is 2.178.2 or higher
🔧 Temporary Workarounds
Avoid credential plugins with expiration properties
allTemporarily stop using credential plugins that return expiration properties until patched.
Secure console output
linuxRedirect or filter AWS CDK CLI output to prevent credential exposure in logs.
# Example: Pipe output to file and filter sensitive data
cdk deploy 2>&1 | grep -v 'credentials' > output.log
🧯 If You Can't Patch
- Monitor and secure all logs containing AWS CDK CLI output
- Implement strict access controls for systems running AWS CDK CLI
🔍 How to Verify
Check if Vulnerable:
Check if using AWS CDK CLI version below 2.178.2 with credential plugins returning expiration properties.Check Version:
cdk --versionVerify Fix Applied:
Run 'cdk --version' and confirm version is 2.178.2 or higher.📡 Detection & Monitoring
Log Indicators:
- AWS credentials appearing in console logs
- AWS CDK CLI output containing credential strings
Network Indicators:
- Unusual AWS API calls from unexpected locations if credentials are compromised
SIEM Query:
source="console_logs" AND "AWS_ACCESS_KEY_ID" OR "AWS_SECRET_ACCESS_KEY"