Rud5G

import * as cdk from 'aws-cdk-lib';
import * as pipelines from 'aws-cdk-lib/pipelines';

import { Construct } from 'constructs';
import { PipelineStage } from '../pipeline-stage/pipeline-stage';
import { environments } from '../pipeline-config/pipeline-config';

export class PipelineStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

Rud5G

import * as apigw from 'aws-cdk-lib/aws-apigateway';
import * as cdk from 'aws-cdk-lib';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as nodeLambda from 'aws-cdk-lib/aws-lambda-nodejs';
import * as path from 'path';
import * as s3 from 'aws-cdk-lib/aws-s3';

import { Construct } from 'constructs';

Rud5G

import * as cdk from 'aws-cdk-lib';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as s3 from 'aws-cdk-lib/aws-s3';

import { Construct } from 'constructs';
import { RemovalPolicy } from 'aws-cdk-lib';

export interface StatefulStackProps extends cdk.StackProps {
  bucketName: string;
}

Rud5G

import * as cdk from 'aws-cdk-lib';

import { Construct } from 'constructs';
import { EnvironmentConfig } from '../pipeline-types/pipeline-types';
import { StatefulStack } from '../../app/stateful/stateful-stack';
import { StatelessStack } from '../../app/stateless/stateless-stack';

// this is our stage made up of multiple stacks which will be deployed to various environments
// based on config i.e. feature-dev, staging, prod, which also includes our application config
export class PipelineStage extends cdk.Stage {

Rud5G

import * as dotenv from 'dotenv';

import {
  Account,
  EnvironmentConfig,
  Region,
  Stage,
} from '../pipeline-types/pipeline-types';

dotenv.config();

Rud5G

export interface EnvironmentConfig {
  env: {
    account: string;
    region: string;
  };
  stageName: string;
  stateful: {
    bucketName: string;
  };
  stateless: {

Rud5G

...

// add the feature-dev stage with the relevant environment config to the pipeline
// this is the test stage (beta)
const featureDevStage: PipelineStage = new PipelineStage(
  this,
  'FeatureDev',
  {
    ...environments.featureDev,
  }

Rud5G

APSB23-50

https://helpx.adobe.com/security/products/magento/apsb23-50.html

Privilege Escalation

The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.

If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:

Rud5G

#
# Based on offical image from https://nextjs.org/docs/deployment#docker-image
# See dockerfile: https://github.com/vercel/next.js/blob/canary/examples/with-docker/Dockerfile
#

FROM node:16-alpine AS deps
RUN apk add --no-cache libc6-compat git curl python3 make g++
WORKDIR /opt/app
RUN addgroup --system --gid 1001 app
RUN adduser --system --uid 1001 app -h /opt/app

Rud5G

import { SSM } from 'aws-sdk';

/**
 * Get the value for a parameter in SSM Parameter Store. By default, decrypt
 * the value as we assume it is stored as a "SecretString"
 *
 * Ref: https://gist.github.com/cbschuld/938190f81d00934f7a158ff223fb5e02
 *
 * @param ssm The SSM client
 * @param name Name of the parameter