CVE-2025-2598
MEDIUMAWS Cloud Development Kit 2.172.0-2.178.2 - Exposure of Sensitive System Information via Credential Plugin
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-2598. PoCs published by Catnip-Express-Maxim, SallyXVIII.
AI-analyzed exploit summary This script exploits a vulnerability in AWS CDK versions 2.172-2.178.0/1 to extract AWS credentials from a plugin file and exfiltrate logs to a remote server. It checks for specific CDK versions and extracts access keys, secret keys, session tokens, and expiration dates.
Description
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Exploits (2)
This script exploits a vulnerability in AWS CDK versions 2.172-2.178.0/1 to extract AWS credentials from a plugin file and exfiltrate logs to a remote server. It checks for specific CDK versions and extracts access keys, secret keys, session tokens, and expiration dates.
This script exploits a vulnerability in AWS CDK versions 2.172-2.178 and 2.178.0-1 to extract AWS credentials from a plugin file. It checks for the presence of the CDK tool, verifies the version, and extracts credentials if the vulnerable version is detected.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N