Hulumi IAM Role Policy Bypass via Multiple OIDC Providers

Executive Summary

Hulumi is an open-source toolkit for secure cloud infrastructure. Prior to version 1.4.0, a flaw allowed bypassing IAM-role policy checks when a role trusted multiple OIDC providers. This means unauthorized access could occur if the role incorrectly permitted multiple providers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your IAM roles trust multiple OIDC providers and verify if the Principal.Federated field contains a JSON array. Inspect the policy rules G_OIDC_1 and G_OIDC_2 for incorrect handling of provider lists. Upgrade to @hulumi/policies version 1.4.0 or later to ensure proper detection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to bypass security controls and gain unauthorized access to cloud resources if the affected Hulumi version is used. It may lead to data breaches, resource misuse, or other security incidents.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows bypassing IAM-role policy checks when the role trusts multiple OIDC providers, which could lead to unauthorized access or privilege escalation. This may violate compliance requirements for GDPR (data protection), HIPAA (health data security), or other standards by enabling unauthorized access to sensitive resources.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Hulumi to version 1.4.0 or later to patch the IAM-role policy bypass issue. Review IAM roles trusting multiple OIDC providers for misconfigurations.

Useful 0 Not Useful 0