CVE-2024-28056

Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.

• CWE-276

• https://aws.amazon.com/security/security-bulletins/AWS-2024-003/Vendor Advisory
• https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.jsonExploit
• https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1Patch
• https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1Release Notes
• https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/Exploit, Third Party Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2024-003/Vendor Advisory
• https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.jsonExploit
• https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1Patch
• https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1Release Notes
• https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/Exploit, Third Party Advisory

Published

Apr 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2805A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20…8.8
• CVE-2024-28050Improper access control in some Intel(R) Arc(TM) & Iris(R) X…5.5
• CVE-2024-28051Out-of-bounds read in some Intel(R) VPL software before vers…2.2
• CVE-2024-28052The WBR-6012 is a wireless SOHO router. It is a low-cost dev…7.5
• CVE-2024-28053Resource Exhaustion in Mattermost Server versions 8.1.x befo…6.5
• CVE-2024-28054Amavis before 2.12.3 and 2.13.x before 2.13.1, in part becau…7.4
• CVE-2024-28058In RSA NetWitness (NW) Platform before 12.5.1, even when an …7.5
• CVE-2024-2806A vulnerability classified as critical has been found in Ten…9.8
• CVE-2024-28060An issue was discovered in Apiris Kafeo 6.4.4. It permits DL…7.3
• CVE-2024-28061An issue was discovered in Apiris Kafeo 6.4.4. It permits a …6.3
• CVE-2024-28063Kiteworks Totemomail through 7.0.0 allows /responsiveUI/Enve…6.1
• CVE-2024-28064Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /respon…9.8