CyberRota Analysis
AI-GeneratedThe Amazon SageMaker Python SDK prior to versions 3.11.0 and 2.256.0 is vulnerable due to the cleartext storage of sensitive information in its decorator pipeline component. This flaw allows authenticated remote users to extract the HMAC signing key from API responses, potentially enabling them to forge valid integrity signatures and execute arbitrary code within another user's pipeline context. Organizations using these affected versions should prioritize remediation to prevent unauthorized access and execution risks within their AWS environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.