Attributed metadata history
Up to 100 retained publisher events per page for b78acbd7bf08c3c651a67f52f0c4157201eb3b5fadfceb857f3c3e4e2b386325. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
The AWS CodeStar service had an undocumented API (codestar:CreateProjectFromTemplate) that allowed users with broadly-scoped CodeStar permissions to create a CodeStar project. As part of the creation process, AWS would create a new CodeStarWorker IAM policy & attach it to the user making the call. This policy granted full access to over 50 AWS services, including iam:AttachRolePolicy, iam:AttachUserPolicy and iam:PutRolePolicy permissions, which would allow the user to escalate to full administrator access. Following disclosure, AWS removed the majority of access granted by the CodeStarWorker policy, but this is still a viable escalation path if there are other misconfigurations in the environment.
Fingerprint: 073daf15664ab0e5404f332d194daf5db362d35e9188fe8333e3ab4535d4ae11