Dependency Confusion with AWS CodeArtifact
Source: YouTube · John Hammond · published Jul 12, 2023 · 16:17
This video demonstrates a critical dependency confusion vulnerability in AWS Code Artifact that can lead to remote code execution 0:00-0:20.
Key Takeaways:
• AWS Code Artifact allows companies to store private packages but is vulnerable to dependency confusion where malicious actors can upload packages with same names but higher versions 1:18-1:33
• The vulnerability occurs when repositories are configured to pull from public repositories, allowing malicious packages to be prioritized over internal ones 3:16-4:07
• AWS acknowledged the issue in December 2021 and released security fixes in Q2 2022, but older configurations may still be vulnerable 4:10-4:46
• The demo shows how an attacker can publish a malicious package to npm that gets installed instead of the internal package, executing arbitrary code 6:00-10:32
• Attackers can discover internal package names through GitHub dorks, source maps, or predictable naming conventions used by companies 10:33-13:00
The vulnerability poses significant risks to CI/CD pipelines, developer machines, and potentially production environments if not properly addressed 13:08-15:01.
Sources:
- 0:00-0:20 Introduction to dependency confusion vulnerability
- 1:18-1:33 Overview of AWS Code Artifact service
- 3:16-4:07 How dependency confusion works
- 4:10-4:46 AWS response timeline and fixes
- 6:00-10:32(https://www.youtube.com/watch?v=FBWpX8icMMo&t=360
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
so if a malicious actor knows the name of one of your internal packages and your repository setup to pull from a public one and they upload a bigger version to the public repository then the repository will decide that the malicious package is the one you want and that's what you will get installed for companies that are still using this you need to check this uh you could be in a lot of risk already hey thanks so much everyone tuning in Hey listen if you have not checked out the last video in this little series and playlist and Saga that we have going on here it was a super cool demo that Carlos pull up over from halborn was showcasing how you could use code build with a custom Docker container Docker image Docker environment that you could use some men in the middle efforts and potential…