Incorrect Permission Assignment for Critical Resource Affecting awscli package, versions [,1.44.78)

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the _create_config path in awscli/customizations/codedeploy/register.py. An attacker can read the CodeDeploy on-premises configuration file by accessing it on the same Unix-like host after aws deploy register writes credential-bearing data, because the file is created with default open(..., 'w') permissions that can leave it world-readable. This exposes the region, IAM user ARN, access key ID, and secret access key to other local users, allowing them to reuse the credentials and impersonate the registered on-premises instance.

Notes

• On Unix-like systems, the vulnerable path depends on the process umask when aws deploy register creates DEFAULT_CONFIG_FILE; with the common default umask, the file can end up mode 0644 and readable by other local users.
• The issue applies to the on-premises CodeDeploy registration flow that writes the credential-bearing instance config file for later use by aws deploy install --config-file, not to the general aws CLI profile/config file handling.

Workarounds

• Run aws deploy register only on hosts where other local users are trusted, or isolate the registration on a single-user machine, to prevent same-host users from reading the generated CodeDeploy configuration file and reusing the embedded credentials.
• Restrict access to the generated CodeDeploy configuration file named by DEFAULT_CONFIG_FILE so only the intended account can read it, to prevent disclosure of the region, IAM user ARN, access key ID, and secret access key to other local users.

• AWS Security Aavisory
• GitHub Commit 1.44.78
• GitHub Commit 2.34.29
• Maintainer's Advisory