CVE-2024-45037 json
AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template
published 2024-08-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2637 , GHSA-qj85-69xf-2vxq
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates. We identified an issue in AWS Cloud Development Kit (CDK) which, under certain conditions, can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access. This issue does not affect the availability of the specific API resources. Authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure, and modification issues. Impacted versions: >=2.142.0;<=2.148.0. A patch is included in CDK versions >=2.148.1. Users are advised to upgrade their AWS CDK version to 2.148.1 or newer and re-deploy their application(s) to address this issue.
Patch / fix
- npm aws-cdk 2.148.1
- amazon aws_cloud_development_kit 2.148.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | aws-cdk | >=2.142.0, <2.148.1 |
2.148.1 |
Affected products
- aws aws-cdk
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/aws/aws-cdk/commit/4bee768f07e73ab5fe466f9ad3d1845456a0513b
web, patch
-
github.com
/aws/aws-cdk/security/advisories/GHSA-qj85-69xf-2vxq
web, vendor-advisory
-
docs.aws.amazon.com
/cdk/v2/guide/home.html
web, product
-
github.com
/aws/aws-cdk/releases/tag/v2.148.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-45037
advisory
-
github.com
/aws/aws-cdk
package
Sources
- CVE List CVE-2024-45037
- GitHub Advisory GHSA-qj85-69xf-2vxq
- NVD CVE-2024-45037
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.