AWS Amplify Studio Input Validation Vulnerability in Component Property Expressions
Vulnerability
A vulnerability exists in the AWS Amplify Studio UI component property expressions within the aws-amplify/amplify-codegen-ui package, affecting versions through 2.20.2. The issue arises from a lack of input validation, which could enable an authenticated user with the ability to create or modify components to execute arbitrary JavaScript code during the component rendering and build process.
Impact
Exploitation of this vulnerability could lead to the execution of arbitrary JavaScript code, potentially allowing for malicious actions during the component rendering and build process.
Remediation
Users are advised to upgrade to Amplify Studio aws-amplify/amplify-codegen-ui version 2.20.3. If any forked or derivative code is in use, it should be patched to incorporate the new fixes.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.