A critical privilege escalation vulnerability in Harmonix on AWS allows authenticated users to assume administrative roles, potentially leading to full account compromise.

The flaw stems from an incorrect privilege assignment (CWE-266) where the EKS environment provisioning role is configured to trust the account root principal. This configuration enables any authenticated IAM principal within the same account possessing sts:AssumeRole permissions to elevate their privileges to administrative levels.

The ability for a standard IAM user to escalate to administrative privileges poses a severe risk to the confidentiality, integrity, and availability of the entire AWS environment. Given the CVSS score of 7.2, this vulnerability represents a high-severity threat that could lead to unauthorized data access, infrastructure destruction, or the deployment of persistent malicious backdoors.

Immediate Action: Upgrade the Harmonix on AWS framework to version 0.4.2 or later immediately to apply the corrected IAM trust policy.

Proactive Monitoring: Review AWS CloudTrail logs for suspicious sts:AssumeRole events associated with the EKS provisioning role to identify potential past exploitation attempts.

Compensating Controls: Implement restrictive IAM policies that explicitly deny sts:AssumeRole permissions to unauthorized users until the framework update can be deployed.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant security risk by undermining the principle of least privilege within the AWS environment. Administrators must prioritize updating to version 0.4.2 or later to eliminate the overly permissive trust policy. Failure to remediate this issue may grant attackers full administrative control over the affected infrastructure.