Executive brief
AWS IoT Device SDKs are libraries used to connect IoT devices securely to AWS's MQTT message broker. On Unix/Linux systems, the SDKs incorrectly append user-supplied Certificate Authorities to the system's default trust store instead of replacing it, weakening certificate pinning protections. An attacker with access to a compromised CA certificate could impersonate the MQTT broker and intercept or manipulate device communications, though they cannot forward authenticated messages without the device's private key.
Technical details
The vulnerability is an improper certificate validation (CWE-295) in the TLS context configuration across multiple AWS IoT Device SDK implementations. Instead of overriding the system's default root CA store with a user-supplied CA certificate (as intended for CA pinning), the SDKs append the custom CA to the existing trust store on Unix/Linux systems. This allows TLS handshakes to succeed if the peer certificate chain validates against either the custom CA or any CA in the system's default trust store. An attacker with network proximity and access to a compromised CA in the system's trust store (or who can spoof DNS) can establish a TLS connection to an IoT device by presenting a certificate signed by that CA, potentially intercepting device-to-broker communications. The fix updates the 'aws_tls_ctx_options_override_default_trust_store_*' function in aws-c-io to properly override rather than append to the default trust store. Patches are available in Java v1.5.0, Python v1.6.1, C++ v1.12.7, Node.js v1.5.3, and aws-c-io versions post-0.10.4.
Affected products
- Amazon Web Services AWS IoT Device SDK for Java v2 before 1.5.0 on Linux/Unix
- Amazon Web Services AWS IoT Device SDK for Python v2 before 1.6.1 on Linux/Unix
- Amazon Web Services AWS IoT Device SDK for C++ v2 before 1.12.7 on Linux/Unix
- Amazon Web Services AWS IoT Device SDK for Node.js v2 before 1.5.3 on Linux/Unix
- Amazon Web Services aws-c-io 0.10.4 on Linux/Unix
Timeline
- 2021-11-24: disclosed
- 2021-11-24: patched: Patches released for all affected SDK versions