Lumigo Autodeploy Layer Insecure Permissions Vulnerability Allowing Privilege Escalation

A vulnerability exists in Lumigo's Autodeploy Layer in versions through 1.2.0, where insecure permissions allow attackers to escalate privileges and compromise the customer's cloud account. The issue arises because the 'DeployToNewFunctions' and 'DeployToExistingFunctions' features use an inline policy that grants the 'lambda:UpdateFunctionConfiguration' permission for all resources. This could enable an attacker to update the configurations of other Lambda functions to intercept temporary security credentials from their execution roles, ultimately leading to unauthorized access to the customer's cloud account.

Impact

Exploitation of this vulnerability could result in unauthorized access to temporary security credentials of AWS Lambda execution roles, allowing an attacker to update function configurations and potentially take over the customer's cloud account.