AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction (Research)

A vulnerability in AWS CodeBuild allowing builds triggered by untrusted pull requests to execute attacker-supplied code enabled memory dumping and extraction of secrets (credentials). An attacker leveraged the stolen credentials to inject malicious code into the Amazon Q Developer Extension for Visual Studio; the injected code was intended to delete files but failed to execute as intended. Users are advised to upgrade the extension to version 1.85.0 or later to remove the malicious code.