CVE-2023-50928: sandbox-accounts-for-events security misconfiguration leads to budget exceed
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50928?
CVE-2023-50928 is considered a high severity vulnerability due to the potential for account exploitation and unauthorized access.
How do I fix CVE-2023-50928?
The recommended mitigation for CVE-2023-50928 is to upgrade to version 1.1.0 or later of the Amazon Awslabs Sandbox Accounts for Events.
Who is affected by CVE-2023-50928?
CVE-2023-50928 affects users of the Amazon Awslabs Sandbox Accounts for Events versions prior to 1.1.0.
What can attackers do with CVE-2023-50928?
Attackers exploiting CVE-2023-50928 could potentially claim and access AWS accounts without proper authorization.
Is authentication enough to protect against CVE-2023-50928?
No, simply relying on authentication is not sufficient to protect against CVE-2023-50928, as the vulnerability may still allow unauthorized account claims.