A simple CodeBuild flaw put every AWS environment at risk

A critical misconfiguration in AWS's CodeBuild service allowed complete takeover of the cloud provider's own GitHub repositories and put every AWS environment in the world at risk, according to Wiz security researchers. The Wiz kids disclosed this supply chain snafu to AWS in August, and the cloud giant fixed the security issue in September, before a cybercriminal or government-backed goon stumbled upon the misconfiguration and abused it to spark a worldwide meltdown. This, we're told, prevented a bigger-than-SolarWinds supply chain attack – so be sure to thank your friendly neighborhood security researchers before you go to sleep tonight. "This vulnerability compromised a core library used in the AWS Console itself – the central nervous system of the cloud," Wiz vulnerability researcher Yuval Avrahami told The Register. "SolarWinds gave attackers access to corporate networks. This could have given attackers code execution in the very interface administrators use to manage their entire infrastructure." It's worth noting that last March, Google announced its intention to acquire Wiz for $32 billion and integrate its cloud security offerings into the Google Cloud platform, which competes directly against AWS. The deal has been approved by US regulators but is awaiting approval in the EU and elsewhere. In an analysis shared with The Register ahead of publication, Avrahami and co-authors detailed the supply chain vulnerability they dubbed CodeBreach. It exists in CodeBuild, AWS's...