awslabs sandbox-accounts-for-events up to 1.9.x privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in awslabs sandbox-accounts-for-events up to 1.9.x. Affected is an unknown function. Performing a manipulation results in privileges management. This vulnerability is reported as CVE-2023-51386. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in awslabs sandbox-accounts-for-events up to 1.9.x. This affects an unknown functionality. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.

The weakness was disclosed 12/23/2023 as GHSA-p7w3-j66h-m7mx. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-51386 since 12/18/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.1.0 eliminates this vulnerability. Applying the patch f30a0662f0a28734eb33c5868cccc1c319eb6e79 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• awslabs

Name

• sandbox-accounts-for-events

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9

License

• open-source

Website

• Product: https://github.com/awslabs/sandbox-accounts-for-events/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion