一、 漏洞 CVE-2024-45037 基础信息
漏洞标题
AWS CDK RestApi 在生成最终的CFN模板时，没有正确生成 authorizationScope
来源：AIGC 神龙大模型
漏洞描述信息
N/A
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
来源：AIGC 神龙大模型
漏洞类别
对生成代码的控制不恰当(代码注入)
来源：AIGC 神龙大模型
漏洞标题
AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template
来源：美国国家漏洞数据库 NVD
漏洞描述信息
The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates. We identified an issue in AWS Cloud Development Kit (CDK) which, under certain conditions, can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access. This issue does not affect the availability of the specific API resources. Authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure, and modification issues. Impacted versions: >=2.142.0;<=2.148.0. A patch is included in CDK versions >=2.148.1. Users are advised to upgrade their AWS CDK version to 2.148.1 or newer and re-deploy their application(s) to address this issue.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
来源：美国国家漏洞数据库 NVD
漏洞类别
授权机制不正确
来源：美国国家漏洞数据库 NVD
漏洞标题
AWS Cloud Development Kit 安全漏洞
来源：中国国家信息安全漏洞库 CNNVD
漏洞描述信息
AWS Cloud Development Kit是Amazon Web Services开源的一个开源软件开发框架，用于在代码中定义云基础设施并通过 AWS CloudFormation 进行配置。 AWS Cloud Development Kit存在安全漏洞，该漏洞源于经过身份验证的 Cognito 用户可能会意外访问受保护的 API 资源或方法，从而导致潜在的数据泄露和修改问题。
来源：中国国家信息安全漏洞库 CNNVD
CVSS信息
N/A
来源：中国国家信息安全漏洞库 CNNVD
漏洞类别
其他
来源：中国国家信息安全漏洞库 CNNVD
二、漏洞 CVE-2024-45037 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2024-45037 的情报信息

  • 标题： What is the AWS CDK? - AWS Cloud Development Kit (AWS CDK) v2 -- 🔗来源链接

    标签： x_refsource_MISC

    What is the AWS CDK? - AWS Cloud Development Kit (AWS CDK) v2

  • 标题： Release v2.148.1 · aws/aws-cdk · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    神龙速读
    Release v2.148.1 · aws/aws-cdk · GitHub

  • 标题： AWS CDK RestApi Construct: Authenticated users may have unintended access to protected APIs · Advisory · aws/aws-cdk · GitHub -- 🔗来源链接

    标签： x_refsource_CONFIRM

    神龙速读
    AWS CDK RestApi Construct: Authenticated users may have unintended access to protected APIs · Advisory · aws/aws-cdk · GitHub

  • 标题： fix(apigateway): authorization scope is not added when not explicitly… · aws/aws-cdk@4bee768 · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    fix(apigateway): authorization scope is not added when not explicitly… · aws/aws-cdk@4bee768 · GitHub
  • https://nvd.nist.gov/vuln/detail/CVE-2024-45037