Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

basti-cdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Minimal basti IAM Policy Allows Shell Access

    GHSA-q4pp-j36h-3gqg

    Affected
    • npm basti-cdk < 1.0.1
    Fixed in
    1.0.1· Vendor fix available
    Issue
    The provided Minimal IAM Policy for bastic connect does not include ssm:SessionDocumentAccessCheck. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding. Details basti connect is designed to "securely connect to your RDS/Aurora/Elasticache/EC2 instances", using a bastion instance "with AWS Session Manager port forwarding capability to make the target available on your localhost." The Minimal IAM Policy allows port forwarding via the following statement: This statement does not include the following condition: As a result, the basti connect minimal policy is logically identical to: A basti admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion. For more details on this footgun, see: https://ramimac.me/ssm-iam PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Impact would depend on…

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →