AWS Console Supply Chain Attack Exposes GitHub Repositories to Hijacking
In a recent revelation, Wiz Research uncovered a critical supply chain vulnerability within Amazon Web Services (AWS) that could have allowed attackers to hijack AWS GitHub repositories. This flaw, termed CodeBreach, stemmed from improperly anchored regular expression patterns in AWS CodeBuild webhook filters, specifically concerning the ACTOR_ID parameter.
Understanding the Vulnerability
The core of the issue lay in the absence of the ^ and $ anchors in the regular expression patterns used to filter GitHub user IDs. Without these anchors, the filters matched any user ID containing an approved substring, rather than an exact match. This oversight enabled attackers to exploit eclipse events, where new, longer GitHub IDs incorporated older maintainer IDs, effectively bypassing the intended security measures.
Potential Impact
This vulnerability posed a significant threat to AWS’s platform integrity. By exploiting this flaw, malicious actors could inject harmful code into applications and the AWS Console across numerous environments. Given GitHub’s sequential ID assignment—approximately 200,000 new IDs daily—the likelihood of such overlaps was notably high, especially for the targeted 6-7 digit IDs in key AWS repositories.
Exploitation Mechanism
Attackers could mass-create GitHub Apps via the manifest flow, racing to obtain eclipse IDs. Once successful, they could submit pull requests that triggered privileged builds. In a proof-of-concept attack on the aws/aws-sdk-js-v3 repository (PR #7280), hidden payload code was used to extract a GitHub Personal Access Token (PAT) from the aws-sdk-js-automation account. This was achieved despite previous mitigations implemented after the 2025 Amazon Q incident.
Implications of the Compromise
The stolen PAT granted extensive permissions, including repository access and administrative control over repository hooks. This access enabled attackers to invite collaborators for administrative escalation and directly push changes to the main branch. Compromising the JavaScript SDK posed a risk of infecting its weekly NPM releases, potentially affecting 66% of scanned cloud environments and the AWS Console, which integrates recent SDK versions with user credentials.
AWS’s Response and Mitigation Measures
Upon discovery, AWS acted swiftly to address the vulnerability. Within 48 hours, they corrected the regex flaw, revoked compromised tokens, enhanced memory protections, audited public builds, and confirmed through logs that no exploitation had occurred. AWS also introduced new features such as Pull Request Comment Approval and CodeBuild-hosted runners to block untrusted builds.
Recommendations for Users
To safeguard against similar vulnerabilities, users are advised to:
– Anchor webhook regular expressions to ensure precise matching.
– Utilize fine-grained PATs with minimal scopes to limit potential damage.
– Implement pull request approval gates to scrutinize code changes.
– Regularly scan for vulnerable setups using tools like Wiz queries.
AWS has also recommended disabling automatic pull request builds from untrusted sources to further enhance security.
Broader Implications
This incident underscores the susceptibility of Continuous Integration and Continuous Deployment (CI/CD) pipelines to sophisticated attacks. These systems, due to their complexity and exposure to untrusted inputs, are prime targets for malicious actors. The public disclosure of this vulnerability on January 15, 2026, serves as a critical reminder of the importance of rigorous security practices in software development and deployment processes.
