search

ACloudGuru-Resources / course-mastering-aws-cloudformation

48 stars 119 forks source link

AWS SAR Vulnerability in Course #98

Open johspaeth opened 2 years ago

johspaeth commented 2 years ago

Hi @iDVB

I suggest updating one of the courses, as it contains an AWS SAR security vulnerability that has been recently discovered. We wrote a detailed explanation on the vulnerability.

It affects the bucket policy for the course "Work with Serverless"

It is important to add a link to the source account that deploys to the bucket by adding an additional condition.

            Condition:
              StringEquals:
                "aws:SourceAccount":  <AWS::AccountId>
iDVB commented 2 years ago

Thanks for calling this out. I’ll circle back with ACG about having it updated.

On Mon, Sep 27, 2021 at 9:15 AM Johannes Späth @.***> wrote:

Hi @iDVB https://github.com/iDVB

I suggest updating one of the courses, as it contains an AWS SAR security vulnerability that has been recently discovered. We wrote a detailed explanation https://codeshield.io/blog/2021/08/26/sar_confused_deputy/ on the vulnerability.

It affects the bucket policy https://github.com/ACloudGuru-Resources/course-mastering-aws-cloudformation/blob/master/Ch07%20-%20Work%20with%20Serverless/AWS%20SAR/sar-bucket-policy.json for the course "Work with Serverless"

It is important to add a link to the source account that deploys to the bucket by adding an additional condition.

        Condition:
          StringEquals:
            "aws:SourceAccount":  <AWS::AccountId>

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ACloudGuru-Resources/course-mastering-aws-cloudformation/issues/98, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABOIQWBUINMK6F5CCOPA4TUEBU7HANCNFSM5E2RDFYA .