Critical RCE Vulnerability in AWS Amplify Studio – PoC Now Public

Keypoints

• The vulnerability stemmed from improper input validation in the AWS Amplify Studio component schemas.
• Attackers with authenticated access could inject malicious JavaScript, leading to remote code execution.
• The flaw was exploitable through evaluating untrusted expressions with unsafe techniques like eval().
• A patch was released in version 2.20.3, replacing unsafe eval() with a sandboxed, filtered evaluation method.
• Users are advised to update immediately, review component schemas, and implement strict access controls for mitigation.