Insecure File Permissions in AWS Toolkit for VS Code Allow Token Exposure

Executive Summary

This vulnerability involves insecure file permissions in the CodeCatalyst connection handler within the AWS Toolkit for VS Code. Before version 4.10.0, local users could access world-readable token cache files and obtain CodeCatalyst bearer tokens.

Useful 0 Not Useful 0

Detection Guidance

Check for world-readable token cache files in the AWS Toolkit for VS Code directory. Look for files with sensitive tokens in plaintext. Commands: ls -l <VS Code config directory>/User/globalStorage/amazonwebservices.aws-toolkit-vscode/tokenCache.json and cat <VS Code config directory>/User/globalStorage/amazonwebservices.aws-toolkit-vscode/tokenCache.json

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could read sensitive bearer tokens, potentially gaining unauthorized access to CodeCatalyst resources or data. This could lead to data breaches or account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data, such as GDPR (data confidentiality) or HIPAA (protected health information). Unauthorized token access may lead to data exposure, resulting in non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AWS Toolkit for VS Code to version 4.10.0 or later. Verify permissions on token cache files are not world-readable after upgrade. Remove any exposed tokens and invalidate them in AWS CodeCatalyst.

Useful 0 Not Useful 0