New AWS Console Supply Chain Attack Allows Hijack of AWS GitHub Repositories
Wiz Research has identified a vulnerability, termed CodeBreach, stemming from unanchored regular expression patterns in CodeBuild webhook filters for the ACTOR_ID parameter. These filters are intended to restrict builds to trusted GitHub user IDs.
Wiz Research has identified a vulnerability, termed CodeBreach, stemming from unanchored regular expression patterns in CodeBuild webhook filters for the ACTOR_ID parameter. These filters are intended to restrict builds to trusted GitHub user IDs.
Without ^ and $ anchors, the filters matched any user ID that contained an approved substring, allowing unauthorized access through "eclipse" events where new, longer GitHub IDs included older maintainer IDs.
This supply chain vulnerability posed a risk of platform-wide compromise, potentially allowing the injection of malicious code into applications and the AWS Console across numerous AWS environments.
GitHub's sequential ID assignment, generating approximately 200,000 IDs daily, frequently resulted in overlaps for the targeted 6-7 digit IDs across four AWS repositories: aws/aws-sdk-js-v3, aws/aws-lc, corretto/amazon-corretto-crypto-provider, and awslabs/open-data-registry.
Attackers exploited this by mass-creating GitHub Apps via the manifest flow to compete for eclipse IDs, then submitted pull requests that triggered privileged builds.
In a proof-of-concept against aws/aws-sdk-js-v3 (PR #7280), hidden payload code was used to extract a GitHub Personal Access Token (PAT) from the aws-sdk-js-automation account, despite previous mitigations.
These filters are intended to restrict builds to trusted GitHub user IDs.
The PAT granted access to repo and admin:repo_hook scopes, enabling collaborator invitations for administrative escalation and direct main branch pushes.
Compromising the JavaScript SDK risked affecting its weekly NPM releases, impacting 66% of scanned cloud environments and the AWS Console, which integrates recent SDK versions with user credentials.
The stolen PAT also controlled related private repositories, amplifying supply chain risks. Wiz halted escalation after the proof-of-concept and responsibly disclosed the findings on August 25, 2025.
AWS addressed the regex flaw within 48 hours, revoked tokens, enhanced memory protections, audited public builds, and confirmed no exploitation occurred via logs.
No customer data was impacted. New features, such as Pull Request Comment Approval and CodeBuild-hosted runners, now prevent untrusted builds.
Users are advised to anchor webhook regexes, use fine-grained PATs with minimal scopes, enable PR approval gates, and scan for vulnerable setups using Wiz queries.
AWS has recommended disabling automatic PR builds from untrusted sources. The attack flow diagram illustrates the path from malicious PR to Console risk.
An AWS Spokesperson stated that AWS immediately investigated Wiz's research and found no impact on the confidentiality or integrity of any customer environment or AWS service. Additional remediations were implemented to mitigate potential future threats.
This incident highlights CI/CD pipelines as prime targets due to their complexity, privilege-rich nature, and exposure to untrusted inputs. Public disclosure occurred on January 15, 2026.
Based on reporting by Cyber Security News.