Improper Neutralization of Special Elements in Data Query Logic
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-943: Improper Neutralization of Special Elements in Data Query Logic |
| OWASP | A01:2017 - Injection |
| Confidence Level | Medium |
| Impact Level | High |
| Likelihood Level | Medium |
Description#
User input from the Lambda event object is being passed directly into DynamoDB queries without proper validation or sanitization. This can allow attackers to inject malicious data into database operations, leading to insecure database access.
Impact#
If exploited, an attacker could manipulate database queries to access, modify, or delete data they shouldn’t, potentially exposing sensitive information or corrupting your database. This can lead to data breaches, data loss, or unauthorized actions within your AWS environment.