The vulnerability stemmed from unanchored or insufficiently restrictive regular expressions configured as webhook filters for AWS CodeBuild in specific AWS-managed open source GitHub repositories (aws-sdk-js-v3, aws-lc, amazon-corretto-crypto-provider, awslabs/open-data-registry). These filters were intended to limit trusted actor IDs but allowed a predictably acquired actor ID to bypass restrictions and gain administrative commit permissions. This was a repository-specific configuration issue, not a flaw in the CodeBuild service itself. The issue was responsibly disclosed by a security research team, who demonstrated the ability to commit an empty code change without causing harm. AWS remediated the misconfiguration rapidly and implemented additional mitigations such as credential rotations and enhanced build process protections. AWS also audited other repositories and logs to confirm no exploitation occurred beyond the research demonstration.

The impact was limited to the potential for unauthorized administrative commits to the affected open source repositories due to misconfigured webhook filters. No inappropriate code was introduced, and there was no impact on AWS customer environments, AWS services, or infrastructure. The issue was confined to specific AWS-managed open source GitHub repositories and did not affect the CodeBuild service itself. No known exploitation in the wild has been reported.

AWS has already remediated the issue by correcting the webhook filter configurations within 48 hours of disclosure. Additional mitigations included credential rotations and enhanced protections for build processes containing sensitive credentials. AWS audited all other AWS-managed open source repositories to ensure no similar misconfigurations exist and reviewed logs to confirm no further exploitation. No customer action is required. Users should follow AWS best practices for CodeBuild webhook filters and consider using pull request build policies for defense in depth.