# CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Unanchored ACTOR_ID regex in AWS CodeBuild webhook filters let a crafted GitHub bot ID bypass PR build gating, leaking a PAT with admin over aws-sdk-js-v3.

- Payout: Research
- Severity: critical
- Program: AWS CodeBuild
- Credited: Wiz Research
- Disclosed: 2026-01-15
- Write-up quality: 9/10
- Original: https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-codebreach-vulnerability-aws-codebuild
- Tags: domain:cloud domain:infra impact:integrity impact:internal-access kind:research platform:threat-intel sev:critical tech:ci-cd tech:github-actions technique:race-window technique:recon vuln:auth-bypass

**Target:** AWS CodeBuild CI pipelines connected to AWS GitHub repositories
**Root cause:** CodeBuild webhook ACTOR_ID filters were treated as unanchored regexes, so any GitHub user ID containing an approved maintainer ID as a substring passed the allow-list.
**Steps:**
1. Enumerate public CodeBuild projects via commit status links; read webhook filters from the public dashboard.
2. Identify ACTOR_ID filters using pipe-separated 6-7 digit maintainer IDs (e.g. aws/aws-sdk-js-v3).
3. Sample current GitHub ID via Enterprise org-creation API, then delete the org.
4. Pre-create 200 GitHub App manifest flows, collecting confirmation URLs.
5. When live ID count is ~100 below target (e.g. 226755743), visit all confirmation URLs simultaneously to register bot users containing the maintainer ID.
6. Fork repo, open PR with a malicious NPM dependency that dumps build process memory to exfiltrate the GitHub token.
7. Use leaked aws-sdk-js-automation PAT (repo, admin:repo_hook) to invite own user as repo admin.
**How found:** Prompted by the Amazon Q CodeBuild supply-chain attack, Wiz scanned public CodeBuild dashboards linked from commit statuses. Noticed ACTOR_ID filters used pipe separators, recognized them as regex, and hypothesized unanchored matching allows superstring IDs. Then reasoned GitHub sequential IDs create periodic 'eclipses' where a new ID contains an old maintainer ID.
**Exploitation:** Attacker registers a GitHub bot whose numeric ID contains a trusted maintainer ID, bypassing the unanchored ACTOR_ID regex. A PR triggers a CodeBuild build running attacker code, which memory-dumps the build process to steal the aws-sdk-js-automation Classic PAT. The token's repo scope allows adding a collaborator as admin, granting push to main, PR approval, and secret exfiltration for supply-chain injection into weekly SDK releases.
**Escalation:** PAT repo scope abused to invite attacker account as repository administrator, escalating from build-environment code execution to full repo admin and potential NPM supply-chain compromise affecting AWS Console.
**Insight:** Public CodeBuild dashboards leak webhook filter configs via commit status links; pipe-separated ID lists are regexes, and unanchored patterns match superstrings. GitHub's sequential ID space plus the App manifest flow enables racing to register an ID containing a target's numeric ID.