Is CVE-2021-40830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-40830 being exploited in the wild.

How severe is CVE-2021-40830?

Low severity, with a CVSS score of 3.1, published 23 November 2021.

Which products and versions are affected?

Amazon Web Services AWS IoT Device SDK for C++ v2 before 1.12.7 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Java v2 before 1.5.0 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Node.js v2 before 1.5.3 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Python v2 before 1.6.1 on Linux/Unix; and 4 more.

Is there a fix for CVE-2021-40830?

Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.5.0 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later; awsiotsdk (PyPI): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-40830 attacked?

It is attacked from the adjacent network or over the network, in a software library.

Am I affected by CVE-2021-40830?

Check whether you run Amazon Web Services AWS IoT Device SDK for C++ v2, Amazon Web Services AWS IoT Device SDK for Java v2, Amazon Web Services AWS IoT Device SDK for Node.js v2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-40830: AWS IoT Device SDK v2 CA pinning bypass in certificate verification

CVE-2021-40830 · Severity: low · CVSS 3.1 · Published 2021-11-23

AWS IoT Device SDKs are libraries used to connect IoT devices securely to AWS's MQTT message broker. On Unix/Linux systems, the SDKs incorrectly append user-supplied Certificate Authorities to the system's default trust store instead of replacing it, weakening certificate pinning protections. An attacker with access to a compromised CA certificate could impersonate the MQTT broker and intercept or manipulate device communications, though they cannot forward authenticated messages without the device's private key.

Technologies: Amazon Web Services Aws-C-Io, software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven), aws-iot-device-sdk-v2 (npm), awsiotsdk (PyPI). Vendors: Amazon Web Services, Maven, npm, PyPI.

Quick answers

Is CVE-2021-40830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-40830 being exploited in the wild.
How severe is CVE-2021-40830?: Low severity, with a CVSS score of 3.1, published 23 November 2021.
Which products and versions are affected?: Amazon Web Services AWS IoT Device SDK for C++ v2 before 1.12.7 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Java v2 before 1.5.0 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Node.js v2 before 1.5.3 on Linux/Unix; Amazon Web Services AWS IoT Device SDK for Python v2 before 1.6.1 on Linux/Unix; and 4 more.
Is there a fix for CVE-2021-40830?: Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.5.0 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later; awsiotsdk (PyPI): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-40830 attacked?: It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2021-40830?: Check whether you run Amazon Web Services AWS IoT Device SDK for C++ v2, Amazon Web Services AWS IoT Device SDK for Java v2, Amazon Web Services AWS IoT Device SDK for Node.js v2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.5.0 or later

# set software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk to 1.5.0 in your pom.xml or build.gradle

aws-iot-device-sdk-v2 (npm): upgrade to 1.5.3 or later
```
npm install aws-iot-device-sdk-v2@1.5.3
```
awsiotsdk (PyPI): upgrade to 1.6.1 or later
```
pip install "awsiotsdk>=1.6.1"
```

Technical details

The vulnerability is an improper certificate validation (CWE-295) in the TLS context configuration across multiple AWS IoT Device SDK implementations. Instead of overriding the system's default root CA store with a user-supplied CA certificate (as intended for CA pinning), the SDKs append the custom CA to the existing trust store on Unix/Linux systems. This allows TLS handshakes to succeed if the peer certificate chain validates against either the custom CA or any CA in the system's default trust store. An attacker with network proximity and access to a compromised CA in the system's trust store (or who can spoof DNS) can establish a TLS connection to an IoT device by presenting a certificate signed by that CA, potentially intercepting device-to-broker communications. The fix updates the 'aws_tls_ctx_options_override_default_trust_store_*' function in aws-c-io to properly override rather than append to the default trust store. Patches are available in Java v1.5.0, Python v1.6.1, C++ v1.12.7, Node.js v1.5.3, and aws-c-io versions post-0.10.4.

Affected products

Amazon Web Services AWS IoT Device SDK for Java v2 before 1.5.0 on Linux/Unix
Amazon Web Services AWS IoT Device SDK for Python v2 before 1.6.1 on Linux/Unix
Amazon Web Services AWS IoT Device SDK for C++ v2 before 1.12.7 on Linux/Unix
Amazon Web Services AWS IoT Device SDK for Node.js v2 before 1.5.3 on Linux/Unix
Amazon Web Services aws-c-io 0.10.4 on Linux/Unix

Identifiers

CVE-2021-40830
GHSA-c4rh-4376-gff4
PYSEC-2021-863

Timeline

2021-11-24: disclosed
2021-11-24: patched: Patches released for all affected SDK versions

References

https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.