CVE-2023-50928 sandbox-accounts-for-events security misconfiguration leads to budget exceed
Authenticated users can claim empty AWS accounts by manipulating API requests with invalid event IDs, leading to unauthorized resource access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-50928?
CVE-2023-50928 is a high-severity missing authorization vulnerability in awslabs sandbox-accounts-for-events, published on 22 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
Weakness: CWE-284
Which versions are affected by CVE-2023-50928?
It affects 1 product.
Products include Amazon Awslabs Sandbox Accounts for Events.
How do I fix CVE-2023-50928?
No fix has been published for CVE-2023-50928 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-50928 being exploited?
There is no known exploitation of CVE-2023-50928 in the wild and no public exploit code.
Other vulnerabilities in awslabs sandbox-accounts-for-events
Sources
Also known as GHSA-cg8w-7q5v-g32r.