CyberRota Analysis
AI-GeneratedPrior to version 1.4.0, the AccountFoundation component of the Hulumi toolkit allowed AWS accounts to have their CloudTrail and Config audit logs deleted by any principal with S3 delete permissions, undermining the expected tamper-resistance of the startup-hardened tier. Additionally, sandbox-tier deployments lacked any audit immutability, further exposing users to potential data manipulation risks. Organizations utilizing Hulumi for cloud infrastructure should prioritize upgrading to version 1.4.0 to mitigate these vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.