Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aws-amplify/amplify-cli

              dev @ aa9d525
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 67 prior fixes. Scrutinize any change in this area.

packages/graphql-auth-transformer/src/ModelAuthTransformer.ts: most-fixed (13 issues). Treat as high-risk during review.

66 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Systemic logic flaws in the generated AppSync Velocity Template Language (VTL) resolver logic allowed widespread authorization bypasses across query, mutation, and subscription operations. Issues stemmed from incorrect group/owner check templates, list/prefix matching flaws, and improper parsing of stringified custom identity claims.

Privilege Escalation: Insecure resource mappings in CloudFormation templates generated wildcard `iam:PassRole` permissions, enabling non-admin users to elevate their privileges by passing arbitrary roles to AWS services.

Command Injection: Use of shell-evaluated child process APIs (`child_process.execSync`) during raw APNS certificate parsing permitted arbitrary shell command execution via crafted inputs.