CodeBreach: Missing Regex Anchors Exposed AWS Console to Takeover

A seemingly minor misconfiguration in a regular expression could have allowed attackers to seize control of critical AWS infrastructure, potentially compromising millions of cloud environments, according to Wiz Research. The vulnerability in AWS’s CodeBuild CI pipelines stemmed from a two-character omission in a build script and involved an ACTOR_ID filter intended to be an allow-list of approved maintainers.

However, the filter used a pipe-separated list of IDs which was interpreted as a regular expression, and crucially it lacked start and end anchors, enabling a string that merely contained a trusted ID to bypass the filter. Wiz researchers demonstrated a window they called an “ID Eclipse,” predicting when a superstring ID would become available and using a coordinated registration burst to shadow a trusted maintainer and submit a privileged pull request.

They obtained the GitHub credentials of the aws-sdk-js-v3 CodeBuild project, potentially granting full administrative control over the repository, with 66% of cloud environments including the JavaScript SDK. AWS mitigated within 48 hours of first disclosure and introduced a new Pull Request Comment Approval build gate to prevent untrusted builds, stating there was no impact on customer environments or AWS services.