Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aws-samples/aws-genai-llm-chatbot

              main @ c0be107
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

lib/authentication/index.ts: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Misalignments in Cognito group naming conventions ('workspace-manager' vs 'workspace_manager') and improper usage of authentication triggers allowed users to bypass intended backend authorization boundaries. Strict parity between frontend group claims and backend checks is required.

Auth Bypass: The absence of centralized, strict API-level access control and role verification on sensitive actions like query dispatching and workspace configurations allowed unauthorized execution of critical features.

Injection: The lack of rigid input validation patterns on Agent IDs exposed internal AWS Bedrock and DynamoDB API calls to potential parameter manipulation and injection attacks.