ZDI-CAN-25426: ZDI-25-205: Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability
Published Apr 7, 2025
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Amazon AWS. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
Affected Software
1 affected component
Amazon AWS CloudFormation
Event History
Apr 7, 2025
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-25426?
The severity of ZDI-CAN-25426 is rated at 9.8 on the CVSS scale, indicating a critical vulnerability.
2
How do I fix ZDI-CAN-25426?
To fix ZDI-CAN-25426, apply the latest security patches provided by Amazon for AWS CloudFormation.
3
What types of attacks can be performed using ZDI-CAN-25426?
ZDI-CAN-25426 allows remote attackers to execute arbitrary code on affected installations of Amazon AWS.
4
Is authentication required to exploit ZDI-CAN-25426?
No, authentication is not required to exploit ZDI-CAN-25426.
5
Which software is affected by ZDI-CAN-25426?
ZDI-CAN-25426 specifically affects Amazon AWS CloudFormation installations.