{"answers":{"affected":"2 open source packages ship an affected version, including aws-cdk-lib.","exploited":"There is no known exploitation of GHSA-qq4x-c6h6-rfxh in the wild and no public exploit code.","fix":"Upgrade aws-cdk-lib to 2.187.0 or later.","what":"GHSA-qq4x-c6h6-rfxh is a vulnerability in aws-cdk-lib, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-qq4x-c6h6-rfxh and fix it if it is affected.\n\nWhat it is: GHSA-qq4x-c6h6-rfxh is a vulnerability in aws-cdk-lib, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-qq4x-c6h6-rfxh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- aws-cdk-lib (npm): affected from 2.37.0; fixed in 2.187.0\n- aws-cdk-lib (npm): affected from 2.37.0; fixed in 2.187.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-qq4x-c6h6-rfxh/ (Markdown: https://insights.sbomify.com/GHSA-qq4x-c6h6-rfxh/index.md)","id":"GHSA-qq4x-c6h6-rfxh","markdown":"https://insights.sbomify.com/GHSA-qq4x-c6h6-rfxh/index.md","name":"GHSA-qq4x-c6h6-rfxh","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"AWS CDK library","requires_auth":"none","summary":"AWS CDK logs sensitive Cognito UserPoolClient secrets in CloudFormation custom resource logs, exposing credentials to anyone with log access.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nThe [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called \"[constructs](https://docs.aws.amazon.com/cdk/v2/guide/constructs.html)\" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.\n\nThe CDK [Cognito UserPool](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPool.html) construct deploys an AWS cognito user pool. An [Amazon Cognito user pool](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools.html) is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘[UserPoolClient](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPoolClient.html)’ or through helper method '[addClient](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPool.html#addwbrclientid-options)'. A user pool client resource represents an Amazon [Cognito user pool client](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-client-apps.html) which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito. \n\nWhen users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs. \n\nThis issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.\n\n### Impact\nTo leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs. \n\nUsers can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.\n\n**Impacted versions: \u003e2.37.0 and \u003c=2.187.0**\n\n### Patches\nThe patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update. \n\nWhen new CDK applications using the latest version are initialized, they will use the new behavior with updated logging. \n\nExisting applications must upgrade to the latest version, change the [feature flag](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md) (@aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.\n\n### Workarounds\nUsers can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().\n\nExample\n\n    export class CustomUserPoolClient extends UserPoolClient {\n\n      private readonly customUserPool : UserPool;\n      private readonly customuserPoolClientId : string;\n      constructor(scope: Construct, id: string, props: UserPoolClientProps) {\n        super(scope, id, props);\n\n        this.customUserPool = new UserPool(this, 'pool', {\n          removalPolicy: RemovalPolicy.DESTROY,\n        });\n\n        const client = this.customUserPool.addClient('client', { generateSecret: true });\n      }\n\n      // Override the userPoolClientSecret getter to always return the secret\n      public get userPoolClientSecret(): SecretValue {\n        // Create the Custom Resource that assists in resolving the User Pool Client secret\n        const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(\n          this,\n          'DescribeCognitoUserPoolClient',\n          {\n        resourceType: 'Custom::DescribeCognitoUserPoolClient',\n        onUpdate: {\n          region: cdk.Stack.of(this).region,\n          service: 'CognitoIdentityServiceProvider',\n          action: 'describeUserPoolClient',\n          parameters: {\n            UserPoolId: this.customUserPool.userPoolId,\n            ClientId: this.customUserPool,\n          },\n          physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),\n          // Disable logging of sensitive data\n          logging: Logging.withDataHidden(),\n        },\n        policy: AwsCustomResourcePolicy.fromSdkCalls({\n          resources: [this.customUserPool.userPoolArn],\n        }),\n        installLatestAwsSdk: false,\n          },\n        ).getResponseField('UserPoolClient.ClientSecret'));\n        \n        return secretValue;\n      }\n    }\n\n### References\nIf you have any questions or comments about this advisory please contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"The [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code.","id":"GHSA-qq4x-c6h6-rfxh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2.187.0"],"introduced":["2.37.0"],"last_affected":[],"package":"aws-cdk-lib","purl":null,"source":"GHSA-qq4x-c6h6-rfxh"},{"ecosystem":"npm","fixed":["2.187.0"],"introduced":["2.37.0"],"last_affected":[],"package":"aws-cdk-lib","purl":"pkg:npm/aws-cdk-lib","source":"GHSA-qq4x-c6h6-rfxh"}],"products":null,"published":"2025-03-31","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"AWS CDK logs sensitive Cognito UserPoolClient secrets in CloudFormation custom resource logs, exposing credentials to anyone with log access.","url":"https://insights.sbomify.com/GHSA-qq4x-c6h6-rfxh/"}