Defense in Depth Enhancement for AWS SDK for JavaScript v3 - @smithy/config-resolver Vulnerability
Summary
GHSA-6475-r3vj-m8vf: AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value. Affects @smithy/config-resolver versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS SDK for JavaScript v3 is a powerful library that enables developers to interact with AWS services using JavaScript. It provides a range of functionalities, including easy access to AWS APIs, support for various AWS services, and seamless integration with JavaScript applications. However, the package '@smithy/config-resolver' has a vulnerability that allows improper configuration of the region parameter, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the ability of an actor with access to the SDK environment to set the region input field to an invalid value. This could result in customer applications improperly routing AWS API calls to non-existent or non-AWS hosts. Although the SDK was functioning as designed, the lack of validation for the region parameter posed a security risk. The issue has been addressed in versions 3.723.0 and later of the AWS SDK for JavaScript v3, which now includes validation for the region formatting.
How To Fix
Minimum fixed version
4.4.0
This is the first release that contains the fix.
npm install @smithy/config-resolver@4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds are necessary, but it is recommended to implement proper input validation in your application code and regularly update to the latest AWS SDK for JavaScript v3 releases. Additionally, follow AWS security best practices for SDK configuration.
Conclusion
The AWS SDK for JavaScript v3 has implemented a defense-in-depth enhancement to address a vulnerability related to the region parameter. By updating to the latest version of the '@smithy/config-resolver' package and following best practices, developers can secure their applications against potential risks.
See every vulnerability recorded for @smithy/config-resolver →
FAQ
The CVSS score of this vulnerability is 3.7, which is classified as LOW severity.
If exploited, this vulnerability could lead to improper routing of AWS API calls, potentially exposing your application to security risks.
Regularly update your dependencies, implement input validation, and follow AWS security best practices to enhance your application's security.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
