Rud5G

'use strict';

/*
 * A flag indicating whether the origin is ready to accept traffic. It's
 * a static value for this example, but you could instead read the value
 * from an S3 bucket with restricted access, a DynamoDB table,
 * or the CloudFront cache.
 */
const originAcceptingTraffic = true;

Rud5G

export interface EnvironmentConfig {
  env: {
    account: string;
    region: string;
  };
  stageName: string;
  stateful: {
    bucketName: string;
  };
  stateless: {

Rud5G

...

// add the feature-dev stage with the relevant environment config to the pipeline
// this is the test stage (beta)
const featureDevStage: PipelineStage = new PipelineStage(
  this,
  'FeatureDev',
  {
    ...environments.featureDev,
  }

Rud5G

APSB23-50

https://helpx.adobe.com/security/products/magento/apsb23-50.html

Privilege Escalation

The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.

If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:

Rud5G

FROM public.ecr.aws/amazonlinux/amazonlinux:2023

# We tell DNF not to install Recommends and Suggests packages, which are
# weak dependencies in DNF terminology, thus keeping our installed set of
# packages as minimal as possible.
RUN dnf --setopt=install_weak_deps=False install -q -y \
    nodejs \
    npm \
    shadow-utils \
    && \

Rud5G

FROM scratch

ADD 26cb4352778d69ccfacbec9c093f43bb62fee5e385995da7e98dbadc18bf4bbc.tar.xz /
ADD 27e72e63101143b7556236b441759818e78135beac997cfb7abed0fe58bac5d6.tar.xz /
ADD 7cec14968c9186694c5f9573dea2caf9f518bb3fcf6047e9848e6e29c8175cac.tar.xz /
ADD a738322a4c0acd0630828ada97df94b1ed2e76f0d6e21faf68e4f9c039503f32.tar.xz /
ADD e9b8b071d9ac433b7e4955d2b29c3c8f8ae8e030638b9411fb35defe7fca8cb1.tar.xz /
ADD ec3491d15ae5bb145e8640631b026f314ed8182355dcb10978323d076b3121c5.tar.xz /

ENV LANG=en_US.UTF-8

Rud5G

#
# Based on offical image from https://nextjs.org/docs/deployment#docker-image
# See dockerfile: https://github.com/vercel/next.js/blob/canary/examples/with-docker/Dockerfile
#

FROM node:16-alpine AS deps
RUN apk add --no-cache libc6-compat git curl python3 make g++
WORKDIR /opt/app
RUN addgroup --system --gid 1001 app
RUN adduser --system --uid 1001 app -h /opt/app

Rud5G

import { SecretsManager } from "@aws-sdk/client-secrets-manager";

const secretsManager = new SecretsManager({});

const TEST_USER_NAME = "TEST_USER";

const getTestUserPassword = async function () {
  const testUserPassword = await secretsManager.getSecretValue({
    SecretId: process.env.COGNITO_TEST_USER_PASSWORD_SECRETS_MANAGER_ARN,
  });

Rud5G

import { SSM } from 'aws-sdk';

/**
 * Get the value for a parameter in SSM Parameter Store. By default, decrypt
 * the value as we assume it is stored as a "SecretString"
 *
 * Ref: https://gist.github.com/cbschuld/938190f81d00934f7a158ff223fb5e02
 *
 * @param ssm The SSM client
 * @param name Name of the parameter

Rud5G

import { SSM } from "aws-sdk";

const getParameterWorker = async (name:string, decrypt:boolean) : Promise<string> => {
    const ssm = new SSM();
    const result = await ssm
    .getParameter({ Name: name, WithDecryption: decrypt })
    .promise();
    return result.Parameter.Value;
}