CVE-2024-28056: Amazon Amplify CLI Auth Bypass Vulnerability

CVE-2024-28056 Overview

Amazon AWS Amplify CLI before version 12.10.1 contains a critical insecure permissions vulnerability (CWE-276) that incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, leaving sts:AssumeRoleWithWebIdentity available to threat actors with no conditions.

This vulnerability affected Amplify CLI deployments built between August 2019 and January 2024 where the Authentication component was subsequently removed. If such removal occurred, an "assume role" action may have been possible, potentially allowing unauthorized access to an organization's AWS resources.

Critical Impact

Threat actors could exploit misconfigured IAM role trust policies to assume roles and gain unauthorized access to AWS resources without any conditional restrictions, potentially compromising entire cloud environments.

Affected Products

• Amazon Amplify CLI versions prior to 12.10.1
• Amplify projects built between August 2019 and January 2024 where Authentication component was removed
• IAM roles associated with affected Amplify deployments

Discovery Timeline

• 2024-04-15 - CVE-2024-28056 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2024-28056

Vulnerability Analysis

This vulnerability stems from improper handling of IAM role trust policies during the removal of Authentication components from AWS Amplify projects. When a user removes the Authentication component (such as built-in Cognito resources), the Amplify CLI fails to properly clean up the associated IAM role trust policy.

The core issue lies in the update mechanism for IAM roles when Authentication components are removed. While the Condition property that previously restricted which identity providers could assume the role is deleted, the permissive "Effect":"Allow" statement remains intact. This creates an overly permissive trust policy that allows any entity to call sts:AssumeRoleWithWebIdentity without the originally intended restrictions.

The vulnerability window spans from August 2019 to January 2024, affecting any Amplify project where an authorized AWS user removed an Authentication component during this period. Common scenarios include organizations migrating away from built-in Cognito resources or transitioning to different identity providers.

Root Cause

The root cause is improper access control (CWE-276 - Incorrect Default Permissions) in the Amplify CLI's CloudFormation resource update logic. When processing Authentication component removal, the CLI modifies the IAM role trust policy by removing Condition elements but fails to update or remove the associated Allow effect, leaving the role assumable without proper authorization conditions.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who discovers a misconfigured IAM role trust policy can exploit the vulnerability through the following attack flow:

1. Attacker identifies an Amplify-deployed application that had its Authentication component removed during the vulnerable period
2. Attacker crafts a sts:AssumeRoleWithWebIdentity request targeting the misconfigured IAM role
3. Without conditional restrictions, AWS STS accepts the request and returns temporary credentials
4. Attacker uses the assumed role credentials to access AWS resources with the permissions attached to that role

The exploitation is particularly dangerous because IAM roles associated with Amplify projects often have broad permissions to interact with backend resources such as DynamoDB, S3, Lambda, and AppSync APIs.

Detection Methods for CVE-2024-28056

Indicators of Compromise

• Unexpected sts:AssumeRoleWithWebIdentity API calls in CloudTrail logs from unknown sources
• IAM role trust policies containing "Effect":"Allow" for sts:AssumeRoleWithWebIdentity without Condition elements
• Unusual access patterns to AWS resources from Amplify-associated IAM roles
• CloudTrail events showing role assumption from unrecognized identity providers or principals

Detection Strategies

• Review CloudTrail logs for AssumeRoleWithWebIdentity events on Amplify-associated IAM roles
• Audit all IAM role trust policies created by Amplify CLI for missing Condition blocks
• Implement AWS Config rules to detect overly permissive trust policies on roles matching Amplify naming patterns
• Use AWS IAM Access Analyzer to identify roles that can be assumed by external principals

Monitoring Recommendations

• Enable CloudTrail logging for all AWS STS API calls across affected accounts
• Configure CloudWatch alarms for unusual AssumeRoleWithWebIdentity activity patterns
• Implement continuous monitoring of IAM role trust policy changes using AWS Config
• Deploy SentinelOne Singularity Cloud Security for real-time detection of suspicious IAM role assumptions

How to Mitigate CVE-2024-28056

Immediate Actions Required

• Upgrade AWS Amplify CLI to version 12.10.1 or later immediately
• Audit all IAM roles associated with Amplify projects deployed between August 2019 and January 2024
• Review and remediate trust policies for any roles that had Authentication components removed
• Check CloudTrail logs for any unauthorized role assumption activity during the exposure window

Patch Information

Amazon has addressed this vulnerability in Amplify CLI version 12.10.1. The fix ensures that IAM role trust policies are properly updated when Authentication components are removed, either by removing the Allow effect or by adding appropriate Condition restrictions.

Organizations should upgrade by running:

npm install -g @aws-amplify/cli@latest

For detailed patch information, refer to the AWS Security Bulletin AWS-2024-003 and the GitHub commit.

Workarounds

• Manually audit and update IAM role trust policies to add appropriate Condition elements
• Restrict trust policies to specific identity providers using Condition blocks with StringEquals on cognito-identity.amazonaws.com:aud
• Delete and recreate affected IAM roles with properly scoped trust policies
• Implement AWS Service Control Policies (SCPs) to restrict AssumeRoleWithWebIdentity at the organization level

# Identify Amplify-associated IAM roles and review their trust policies
aws iam list-roles --query "Roles[?contains(RoleName, 'amplify')].{RoleName:RoleName,Arn:Arn}" --output table

# Get the trust policy for a specific role to check for missing Conditions
aws iam get-role --role-name <AMPLIFY_ROLE_NAME> --query "Role.AssumeRolePolicyDocument" --output json