Quick answers
- Is CVE-2021-40831 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-40831 being exploited in the wild.
- How severe is CVE-2021-40831?
- Low severity, with a CVSS score of 3.1, published 23 November 2021.
- Which products and versions are affected?
- Amazon Web Services AWS IoT Device SDK v2 for C++ before 1.14.0, macOS only; Amazon Web Services AWS IoT Device SDK v2 for Java before 1.5.0, macOS only; Amazon Web Services AWS IoT Device SDK v2 for Node.js before 1.6.0, macOS only; Amazon Web Services AWS IoT Device SDK v2 for Python before 1.7.0, macOS only; and 4 more.
- Is there a fix for CVE-2021-40831?
- Yes. software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.5.0 or later; aws-iot-device-sdk-v2 (npm): upgrade to 1.6.0 or later; awsiotsdk (PyPI): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-40831 attacked?
- It is attacked from the adjacent network.
- Am I affected by CVE-2021-40831?
- Check whether you run Amazon Web Services AWS IoT Device SDK v2 for C++, Amazon Web Services AWS IoT Device SDK v2 for Java, Amazon Web Services AWS IoT Device SDK v2 for Node.js or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (Maven): upgrade to 1.5.0 or later
# set software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk to 1.5.0 in your pom.xml or build.gradle - aws-iot-device-sdk-v2 (npm): upgrade to 1.6.0 or later
npm install aws-iot-device-sdk-v2@1.6.0 - awsiotsdk (PyPI): upgrade to 1.7.0 or later
pip install "awsiotsdk>=1.7.0"
Technical details
This vulnerability involves improper certificate management in the aws-tls-ctx-options-override-default-trust-store function on macOS. Instead of replacing the system's default trust store with a user-supplied CA, the SDK appends the user CA to the existing trust store, and SNI validation is not enabled when the CA has been "overridden." An attacker with access to the host's trust stores, or who can compromise a certificate authority already trusted by the system (and spoof DNS), can bypass CA pinning. The attacker can then perform a man-in-the-middle attack on MQTT connections, but lacks the user's private credentials needed to fully authenticate to the actual broker. Patches are available: aws-c-io has been updated, and fixed versions are available for all affected SDKs (Java 1.5.0+, Python 1.7.0+, C++ 1.14.0+, Node.js 1.6.0+).
Affected products
- Amazon Web Services AWS IoT Device SDK v2 for Java before 1.5.0, macOS only
- Amazon Web Services AWS IoT Device SDK v2 for Python before 1.7.0, macOS only
- Amazon Web Services AWS IoT Device SDK v2 for C++ before 1.14.0, macOS only
- Amazon Web Services AWS IoT Device SDK v2 for Node.js before 1.6.0, macOS only
- Amazon Web Services aws-c-io 0.10.7 and earlier, macOS only
Identifiers
- CVE-2021-40831
- GHSA-j3f7-7rmc-6wqj
- PYSEC-2021-864
Timeline
- 2021-11-24: disclosed: Vulnerability published on GitHub and NVD
- 2021-11-24: patched: Fixed versions released: Java 1.5.0+, Python 1.7.0+, C++ 1.14.0+, Node.js 1.6.0+