Technical impact
SQL injection vulnerabilities in custom resource handlers for database-query within the AWS CDK @aws-cdk/aws-redshift-alpha module enable an attacker who can influence construct property values to execute arbitrary SQL statements with Redshift superuser privileges. This flaw, identified as CWE-89, allows privileged operations such as granting access to all cluster users. The impact is that an attacker could effectively execute arbitrary database commands, potentially leading to data exfiltration, unauthorized modifications, or escalation to full cluster control.
Affected Systems
Vulnerable code is present in the AWS CDK aws-redshift-alpha module in versions preceding 2.274.0-alpha.0. Any project that imports or depends on this module and deploys Redshift cluster resources may be affected if it uses an earlier release. The issue does not affect deployments that use version 2.274.0-alpha.0 or later.
Risk and Exploitability
The CVSS score of 7 indicates high severity. EPSS is not available, but the lack of KEV listing suggests no confirmed public exploitation yet. The attack requires an attacker to influence construct property values; thus, trust boundaries and access control around the CDK code are critical. If an attacker gains control over those values, they can run malicious SQL through the superuser, which is a severe risk for any organization using Redshift clusters via this module.
