AWS patches SDK flaw that turned a area subject into credential theft

Amazon Net Companies Inc. has patched a flaw throughout seven of its software program improvement kits after product safety startup Pi Inc. traced a single bug report back to roughly 2,500 situations of the identical defect, Pi revealed at present.

Each AWS SDK builds the hostname it calls from a template. The area drops into the center of https://{service}.{area}.amazonaws.com. A legitimate area seems to be like us-east-1. On the susceptible code paths, nothing checked for that.

Loads of functions let a person choose the area, so Pi’s researchers picked “@attacker.com#”. The SDK constructed https://sts.@attacker.com#.amazonaws.com and signed a request to that deal with. A URL parser reads all the pieces earlier than the @ as a username. The whole lot after the # will get discarded. What survives is attacker.com.

Redirecting an bizarre software programming interface name leaks a request signature. That’s survivable. The AssumeRoleWithWebIdentity name made by Elastic Kubernetes Service workloads, Cognito functions and OpenID Join integrations will not be bizarre. That request carries a bearer token in its physique, in plaintext.

In a single licensed engagement the goal ran inside EKS. The redirected name carried the pod’s Kubernetes service account token to a server the testers managed. Replaying it to AWS Safety Token Service returned dwell credentials contained in the buyer’s account.

Pi mentioned it handed its platform the unique report and nothing else, with no per-language guidelines and no listing of companies to verify. The software program abstracted the susceptible code into what the corporate calls an anti-pattern, an outline of the conduct fairly than the syntax, then went in search of that conduct elsewhere.

AWS generates SDK purchasers for greater than 400 companies from shared service fashions, so a lacking verify within the generator lands in every single place without delay. Python and Ruby had guarded towards it for years. A lot of the others had not.

The repair runs to some traces. Validate the area as a number label, letters, digits and hyphens solely, earlier than it reaches the hostname. That validation lives inside every generated SDK, not in a single shared place. AWS ended up writing it seven occasions.

Pi reported it to AWS on Oct. 14, 2025. A primary patch was dedicated inside per week. The advisories didn’t exit till Jan. 8 and Jan. 9. Go v2 was final. Solely the .NET SDK drew a CVE, CVE-2026-22611, rated low at 3.7 on the CVSS scale, and Pi co-founder and Chief Govt Man Arazi is known as within the acknowledgments.

AWS didn’t body any of this as a vulnerability. Its advisories name the change a defense-in-depth enhancement. Validating that enter, AWS says, is the developer’s job below the shared duty mannequin.

Pi calls the score incomplete. The corporate examined the flaw the place it really runs in third-party platforms that embed an AWS SDK and expose the area subject and mentioned seven of seven have been exploitable. Every leaked dwell AWS credentials to a callback server.

Some have been well-known corporations and a few have been safety distributors. All have been notified and remediated earlier than publication. A per-instance rating charges one final result in a single place, Pi wrote, and has no technique to categorical a category of conduct a code generator has copied into hundreds of purchasers.

Pi  relies in San Francisco. Brightmind Companions and Third Level Ventures led a $35 million spherical for the corporate in June. CrowdStrike Holdings Inc. Chief Govt George Kurtz and Armis Inc. founders Yevgeny Dibrov and Nadir Izrael additionally additionally traders.

Picture: SiliconANGLE/GPT Picture 2