GHSA-9r5x-g8jm-9mjj: Unsafe reflection in Amazon Braket Schemas error mitigation validation
Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document.
We recommend you upgrade to amazon-braket-schemas version 1.32.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-braket-schemasto a version that resolves this vulnerability.Fixed in 1.32.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Machines using amazon-braket-schemas before 1.32.2 are exposed when they retrieve quantum task results from an output location where a remote authenticated user has S3 write access. The risk is on the result-consuming machine, not only on the system that writes the task output.
What does an attacker need to exploit it?
An attacker needs to be authenticated and have permission to write to the S3 location used for quantum task output. They must place a crafted task result document that is later retrieved by a vulnerable consumer.
What is the recommended remediation?
Upgrade amazon-braket-schemas to version 1.32.2 or later. If immediate upgrading is not possible, restrict S3 write access to quantum task output locations and avoid retrieving result documents from locations writable by untrusted users.