CVE-2021-40828: AWS IoT Device SDK hostname verification bypass in TLS

CVE-2021-40828 · Severity: low · CVSS 3.1 · Published 2021-11-23

AWS IoT Device SDK v2 (for Java, Python, C++, and Node.js) is used by applications to connect to AWS IoT services securely. On Windows, when custom certificate authorities are configured, the SDK failed to verify the server's hostname during TLS connections, allowing an attacker on the same network to intercept and redirect traffic to a malicious server, potentially exposing IoT device credentials and data.

Technologies: Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js, Amazon Web Services AWS IoT Device SDK v2 for Python, software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven), aws-iot-device-sdk-v2 (npm), awsiotsdk (PyPI). Vendors: Amazon Web Services, Maven, npm, PyPI.

Quick answers

Is CVE-2021-40828 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-40828 being exploited in the wild.
How severe is CVE-2021-40828?
Low severity, with a CVSS score of 3.1, published 23 November 2021.
Which products and versions are affected?
Amazon Web Services AWS IoT Device SDK v2 for C++ prior to 1.12.7; Amazon Web Services AWS IoT Device SDK v2 for Java prior to 1.3.3; Amazon Web Services AWS IoT Device SDK v2 for Node.js prior to 1.5.1; Amazon Web Services AWS IoT Device SDK v2 for Python prior to 1.5.18; and 3 more.
Is there a fix for CVE-2021-40828?
Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.3.3 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.5.1 or later; awsiotsdk (PyPI): upgrade to 1.5.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-40828 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2021-40828?
Check whether you run Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.3.3 or later
    # set software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk to 1.3.3 in your pom.xml or build.gradle
  • aws-iot-device-sdk-v2 (npm): upgrade to 1.5.1 or later
    npm install aws-iot-device-sdk-v2@1.5.1
  • awsiotsdk (PyPI): upgrade to 1.5.18 or later
    pip install "awsiotsdk>=1.5.18"

Technical details

The vulnerability is an improper certificate validation (CWE-295) affecting the TLS handshake implementation. When a custom Certificate Authority (CA) is added to the trust store on Windows, the SDK did not perform Server Name Indication (SNI) and hostname verification checks during TLS handshake, contrary to the implementation on other platforms. An attacker with adjacent network access could perform a man-in-the-middle (MITM) attack by presenting a valid certificate signed by the overridden CA but for a different hostname. The fix was included in aws-c-io submodule version 0.9.13 onward, with the following patched SDK versions: Java 1.3.3, Python 1.5.18, C++ 1.12.7, and Node.js 1.5.1.

Affected products

  • Amazon Web Services AWS IoT Device SDK v2 for Java prior to 1.3.3
  • Amazon Web Services AWS IoT Device SDK v2 for Python prior to 1.5.18
  • Amazon Web Services AWS IoT Device SDK v2 for C++ prior to 1.12.7
  • Amazon Web Services AWS IoT Device SDK v2 for Node.js prior to 1.5.1

Identifiers

  • CVE-2021-40828
  • GHSA-94jq-q5v2-76wj
  • PYSEC-2021-861

Timeline

  • 2021-11-24: disclosed
  • 2021-11-24: patched: Fixes released for all affected SDK versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.