Security researchers discovered that certain AWS-managed open source GitHub repositories (aws-sdk-js-v3, aws-lc, amazon-corretto-crypto-provider, awslabs/open-data-registry) had misconfigured webhook filters for AWS CodeBuild. These filters used insufficient regular expressions to limit trusted actor IDs, enabling a predictably acquired actor ID to gain administrative permissions and commit code. This was a project-specific configuration issue, not a vulnerability in the CodeBuild service itself. AWS investigated, remediated the issue within 48 hours, rotated credentials, enhanced build process protections, and audited other repositories and logs to confirm no exploitation occurred.

The misconfiguration could have allowed unauthorized administrative access to the affected repositories, potentially enabling inappropriate code commits. However, during the responsible disclosure and research activity, no inappropriate code was introduced, and no AWS customer environments or services were impacted. AWS confirmed no exploitation beyond the demonstrated proof-of-concept occurred.

AWS has remediated the misconfiguration within 48 hours of disclosure, including rotating credentials and implementing additional protections for build processes. AWS audited all other managed open source repositories to ensure no similar issues exist. No customer action is required. Organizations using CodeBuild should ensure webhook actor ID filters are properly scoped and consider using CodeBuild’s pull request build policies as an additional defense-in-depth measure.