CodeBreach: Infiltrating the AWS Console supply chain via CodeBuild and hijacking AWS GitHub repositories

Wiz Research disclosed a vulnerability named CodeBreach: webhook filter regexes used in AWS CodeBuild pipelines to filter build triggers can lack ^ and $ anchors, allowing attackers to bypass the ACTOR_ID whitelist and impersonate trusted users to trigger builds. The research team exploited the incremental nature of GitHub numeric IDs to pre-register new accounts containing trusted maintainer IDs, and used the GitHub App manifest flow to batch register and win the pre-registration race, ultimately gaining administrator permissions on the aws/aws-sdk-js-v3 repository, enabling them to push code to the main branch and steal repository secrets. The AWS JavaScript SDK corresponding to this repository is a core dependency of the AWS Console, and according to their analysis, 66% of cloud environments have this SDK installed.