CVE-2021-40828: AWS IoT Device SDK v2 for Java, Python, C++, and Node.js Server Certificate Hostname Verification Bypass
Summary
CVE-2021-40828: Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certi... Affects awsiotsdk versions < 1.5.18. Fixed in 1.5.18. How to fix ↓
Also tracked for
The same CVE-2021-40828 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS IoT Device SDK v2 is a collection of libraries that enable developers to connect their devices to the AWS IoT Core service. It provides support for multiple programming languages, including Java, Python, C++, and Node.js. The SDK allows devices to securely communicate with the AWS IoT Core using the Transport Layer Security (TLS) protocol. However, prior to version 1.3.3 for Java, 1.5.18 for Python, 1.12.7 for C++, and 1.5.3 for Node.js, the SDKs did not properly verify the server certificate hostname during the TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows.
Vulnerability Detail
The lack of server certificate hostname verification in the affected versions of the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js on Windows could allow an attacker to perform a man-in-the-middle (MITM) attack. By exploiting this vulnerability, an attacker could intercept and modify the communication between the device and the AWS IoT Core, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
1.5.18
This is the first release that contains the fix.
pip install --upgrade "awsiotsdk==1.5.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the SDK is not immediately feasible, a temporary workaround is to avoid overriding the Certificate Authorities (CA) in the trust stores on Windows. By using the default trust store, the server certificate hostname verification will be performed correctly. Here is an example of how to use the default trust store in Python:
import awsiotsdk
awsiotsdk.configure_endpoint(endpoint, ca_path=None)
Conclusion
The AWS IoT Device SDK v2 for Java, Python, C++, and Node.js versions prior to the specified versions on Windows are vulnerable to a server certificate hostname verification bypass. This could allow an attacker to perform a man-in-the-middle attack and potentially compromise the security and integrity of the communication between the device and the AWS IoT Core. It is crucial to update the affected SDKs to the recommended versions or apply the provided workaround to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for awsiotsdk →
FAQ
This vulnerability could allow an attacker to perform a man-in-the-middle (MITM) attack and potentially gain unauthorized access to the communication between the device and the AWS IoT Core. This could lead to data leakage, unauthorized control of devices, or other malicious activities.
The vulnerability affects versions of the AWS IoT Device SDK v2 for Java prior to 1.3.3, Python prior to 1.5.18, C++ prior to 1.12.7, and Node.js prior to 1.5.3 on Windows.
No, this vulnerability only affects the AWS IoT Device SDK v2 on Windows. Other operating systems are not impacted.
Yes, a temporary workaround is to avoid overriding the Certificate Authorities (CA) in the trust stores on Windows and use the default trust store instead. This will ensure that the server certificate hostname verification is performed correctly.
To fix this vulnerability, it is recommended to update the AWS IoT Device SDK v2 for Java to version 1.3.3 or later, Python to version 1.5.18 or later, C++ to version 1.12.7 or later, and Node.js to version 1.5.3 or later. These updated versions include the necessary fixes to properly verify the server certificate hostname during the TLS handshake.
References
Related vulnerabilities
Recent vulnerabilities recorded for awsiotsdk.
