CVE-2025-5025: No QUIC certificate pinning with wolfSSL

Bug reported by Hiroki Kurosawa was disclosed at May 28, 2025, 6:35 am   |   Improper Certificate Validation

CVE-2025-4947: QUIC certificate check skip with wolfSSL

Bug reported by Hiroki Kurosawa was disclosed at May 28, 2025, 6:35 am   |   Improper Validation of Certificate with Host Mismatch

Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:39 am   |   Insufficient Logging

The non-production API endpoints for the bedrock-agent service failed to log to CloudTrail, resulting in silent permission enumeration. A total of 26 non-production endpoints were found that could be used with standard IAM credentials without generating CloudTrail logs. This vulnerability was considered a security issue by AWS, as it allowed for invisible enumeration of permissions.

Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:38 am   |   Insufficient Logging

The bedrock service was found to have 5 non-production API endpoints that could be used with standard IAM credentials to enumerate permissions without logging to CloudTrail. The impacted endpoints allowed the invocation of bedrock:ListImportedModels and bedrock:ListModelImportJobs actions. This vulnerability was reported to AWS, who considered it a security issue.

Non-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:35 am   |   Insufficient Logging

The non-production API endpoint for the EventBridge service was found to fail to log to CloudTrail, resulting in silent permission enumeration. This vulnerability was reported to AWS, as it allowed for the enumeration of permissions of compromised credentials without generating CloudTrail logs, which could be used by adversaries to assess the access they have gained.

Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:34 am   |   Insufficient Logging

The researchers discovered that there are 8 non-production endpoints for the Global Accelerator service which can be used with standard IAM credentials and do not log to CloudTrail. This allows for silent permission enumeration, where an adversary can determine the permissions of compromised credentials without generating any logs.

Non-Production API Endpoints for the Health Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:32 am   |   Insufficient Logging

The AWS Health service was found to have 11 non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could test the capabilities of compromised credentials without generating auditable CloudTrail logs.

Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:30 am   |   Insufficient Logging

The Amazon Pinpoint SMS and Voice, version 2 service was found to incorrectly report the user-agent and network information as "AWS Internal" for five specific API endpoints that are FIPS endpoints. This issue was discovered to be similar to a previous bug reported for the Comprehend Medical and Kendra services, suggesting a potential wider issue across a small number of services. As a result of this vulnerability, an adversary could have performed API calls using these endpoints and evaded the logging of their IP address and operating system information.

Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

Bug reported by Nick Frichette (Datadog) was disclosed at May 28, 2025, 12:24 am   |   Insufficient Logging

The AWS Kendra Intelligent Ranking service was found to incorrectly report the user-agent and network information as "AWS Internal" for four API endpoints that are FIPS endpoints. This issue can lead to the obscuring of request information that may be used to track down an adversary.