A critical misconfiguration in AWS CodeBuild pipelines, dubbed CodeBreach, could have enabled attackers to compromise AWS-managed GitHub repositories—including the widely used AWS JavaScript SDK (aws-sdk-js-v3)—posing a massive supply chain risk across all AWS environments.
What Happened
- Discovery: Reported by Wiz researchers (Aug 25, 2025), fixed by AWS in Sept 2025.
- Root cause: Misconfigured ACTOR_ID regex filters in CodeBuild webhook settings.
- Regex lacked ^ (start) and $ (end) anchors.
- Allowed any GitHub user ID containing a trusted maintainer’s ID as a substring to bypass filters.
- Impact: Attackers could predict sequential GitHub IDs, register bot accounts, and impersonate trusted maintainers.
Exploitation Path
- Trigger build: Malicious actor ID bypasses regex filter.
- Credential leak: Build process exposes GitHub Personal Access Token (PAT) with admin privileges.
- Repository takeover:
- Push malicious code to main branch.
- Approve pull requests.
- Exfiltrate secrets.
- Supply chain compromise: Malicious SDK updates could propagate to AWS Console and customer environments.
Affected Repositories
- aws-sdk-js-v3
- aws-lc
- amazon-corretto-crypto-provider
- awslabs/open-data-registry
Risk Assessment
- Potential impact: Platform-wide compromise of AWS accounts and applications.
- Exploitation likelihood: High, due to predictable GitHub ID sequencing (~every 5 days).
- Status: AWS found no evidence of exploitation in the wild.
AWS Mitigations
- Fixed regex filters with proper anchors.
- Rotated credentials and hardened build processes.
- Implemented additional safeguards for GitHub tokens in memory.
Best Practices for CI/CD Security
- Anchor regex patterns (
^...$) in webhook filters. - Use Pull Request Comment Approval gates to prevent untrusted builds.
- Generate unique PATs per project with minimal permissions.
- Employ dedicated unprivileged GitHub accounts for CI/CD integrations.
- Avoid checking out untrusted code in pull_request_target workflows.
Takeaway
CodeBreach illustrates how subtle CI/CD misconfigurations can escalate into massive supply chain threats. Even without exploitation, the flaw highlights the critical need for rigorous validation in build pipelines, especially when privileged credentials are involved
Leave a Reply