提出 #908568: elenavanengelenmaslova mocknest-serverless 0.9.0 Improper Privilege Management

DESCRIPTION

A privilege-management vulnerability was identified in the optional AWS GitHub OIDC deployment helper resources distributed with mocknest-serverless version 0.9.0.

The affected resources included:

deployment/aws/shared/github-oidc-role.yaml

deployment/aws/shared/update-existing-oidc-role.sh

Related GitHub Actions deployment and publishing workflows

The original AWS IAM trust policy allowed workflows from several mutable branch patterns, including main, feature/* and bugfix/*, to assume a highly privileged AWS role. The accompanying update script further added trust for hotfix/* and pull_request subjects.

The deployment role also included the AWS-managed PowerUserAccess policy and broad permissions across services such as IAM, CloudFormation, S3, Lambda, API Gateway, SQS, CloudWatch Logs and Bedrock.

As a result, a GitHub Actions workflow running under an eligible trusted subject could obtain temporary AWS credentials through GitHub OIDC and perform AWS control-plane operations beyond the minimum permissions required for application deployment.

Successful exploitation required the optional OIDC helper role to have been deployed into an AWS account. The actual impact depended on repository permissions, branch protection, workflow approval settings and the AWS resources accessible through the role.

The issue did not directly affect the MockNest application runtime or application logic. It was limited to the optional OIDC deployment template, update script and related CI/CD configuration.

ATTACK SCENARIO

An attacker with the ability to execute or modify a workflow under a trusted branch subject could request an OIDC token using the id-token: write permission and assume the affected AWS role.

Successful role assumption could be confirmed with:

aws sts get-caller-identity

The excessive permission scope could be demonstrated using non-destructive commands such as:

aws iam list-roles --max-items 5

aws cloudformation list-stacks

SECURITY IMPACT

A successful attacker could potentially:

Create or modify IAM roles and policies

Create or update CloudFormation stacks

Modify Lambda functions and S3 resources

Change API Gateway, SQS or CloudWatch Logs resources

Pass privileged roles to AWS services

Modify deployment infrastructure

Establish persistence through IAM changes

The maximum impact could include compromise of the AWS deployment control plane associated with the affected role.

ROOT CAUSE

The issue was caused by the combination of:

An overly broad GitHub OIDC trust policy covering multiple mutable branch patterns and pull-request-related subjects

An over-privileged AWS deployment role containing PowerUserAccess and additional broad IAM and service permissions

The role was not sufficiently restricted to specific approved deployment workflows and combined deployment, publishing, testing and infrastructure-management capabilities.

AFFECTED COMPONENT

Product:

mocknest-serverless

Affected component:

Optional AWS GitHub OIDC deployment helper template and update script

Affected version:

0.9.0

Affected files:

deployment/aws/shared/github-oidc-role.yaml

deployment/aws/shared/update-existing-oidc-role.sh

.github/workflows/main-aws.yml

.github/workflows/workflow-deploy-aws.yml

.github/workflows/workflow-sar-publish.yml

VENDOR RESPONSE

The maintainer acknowledged that the original OIDC trust policy and permissions were broader than necessary.

The maintainer fixed the issue by restricting the trust boundary, removing trust for feature/*, bugfix/*, hotfix/* and pull-request subjects, removing PowerUserAccess, reducing the deployment-role permissions and updating the helper script and documentation.

The maintainer clarified that the issue affected only the optional deployment helper resources and did not directly affect the MockNest runtime or application logic.

The private GitHub Security Advisory was closed as fixed, and the reporter was credited. However, the maintainer declined to request a CVE or publicly publish the advisory.

DISCLOSURE STATUS

The vulnerability was privately reported, acknowledged and fixed by the project maintainer.

Because the maintainer declined to request a CVE identifier, this report is being submitted to VulDB for an independent vulnerability assessment and determination of CVE eligibility.

Please refer to the specific changes made in commit 6ab3147, dated May 30, 2026.

• ソース: ⚠️ https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b
• ユーザー: changli (UID 99220)
• 送信: 2026年07月29日 12:04 (1 月 ago)
• モデレーション: 2026年09月07日 21:23 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 399670 [elenavanengelenmaslova mocknest-serverless 0.9.0 AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml 特権昇格]
• ポイント: 20