aws-secrets-manager-rotation-lambdas icon indicating copy to clipboard operation
aws-secrets-manager-rotation-lambdas copied to clipboard

Published 20 hours ago • verified publisher icon aws-samples

Secrets rotation lambda is affected by CWE-117 and CWE-93

Open Niffy opened this issue 8 months ago • 1 comments

When looking in AWS inspector it appears the lambda for secret rotation is vulnerable to the following log injection CWEs CWE-117 CWE-93 

User-provided inputs must be sanitized before they are logged. An attacker can use unsanitized input to break a log's integrity, forge log entries, or bypass log monitors.

It marks the severity as high.

The finding occurs here https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/master/SecretsManagerRDSPostgreSQLRotationSingleUser/lambda_function.py#L59

logger.error("Secret %s is not enabled for rotation" % arn)

Having this resolved would be great and means we have no vulnerabilities that are high on our account.

Niffy avatar Feb 21 '25 17:02 Niffy