CVE-2023-35165

Summary

CVE-2023-35165 affects versions 2.0.0 to 2.80.0 of the `aws-cdk-lib` package and 1.57.0 to 1.202.0 of the `@aws-cdk/aws-eks` package in AWS Cloud Development Kit (AWS CDK). The issue lies in the creation of overly permissive roles, `CreationRole` and `default MastersRole`, during the provisioning of Amazon EKS clusters. These roles, used for creating clusters and managing Kubernetes resources, have trust policies that are too broad, potentially granting unintended access. For `CreationRole`, there is no workaround for users with CDK version lower than 1.62.0, while to prevent the creation of `default MastersRole`, users should provide an explicit role via the `mastersRole` property. The vulnerability has been addressed in versions 1.202.0 of `@aws-cdk/aws-eks` and 2.80.0 of `aws-cdk-lib`, which restrict trust policies to specific lambda handler roles.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.