Improper Verification of Cryptographic Signature Affecting aws-cdk-lib package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AWSCDKLIB-8647962
- published19 Jan 2025
- disclosed17 Jan 2025
- creditGavinZZ
Introduced: 17 Jan 2025
NewCVE-2025-23206 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the tls.connect method setting rejectUnauthorized to false by default. An attacker can intercept and manipulate the data transmitted over the connection by exploiting the lack of proper TLS verification.ֿ
Note
The issuer URL is specified by CDK users when defining their CDK application. If they choose to connect to an unauthorized OIDC provider, CDK should not prevent this. Furthermore, the code block is executed within a Lambda environment, which helps mitigate the risk of MITM attacks.
After upgrading to the fixed version, ensure the feature flag
@aws-cdk/aws-iam:oidcRejectUnauthorizedConnectionsis set totrueincdk.context.jsonorcdk.json. More details on AWS CDK feature flags setting can be found here.