Executive brief
A security vulnerability in the ex_aws_sns library allows attackers to bypass signature verification for Amazon Simple Notification Service (SNS) messages. This library is used by Elixir applications to interact with AWS SNS, and an exploit could allow an unauthorized person to send fake notifications that the system treats as legitimate. This could lead to unauthorized data processing, hijacking of message delivery, or disruption of legitimate service subscriptions.
Technical details
The `ExAws.SNS.verify_message/1` function in `ex_aws_sns` versions 2.0.1 through 2.3.4 fetches the signing certificate from the `SigningCertURL` field of an incoming SNS message without validating the URL's protocol or hostname. An unauthenticated attacker can provide a URL pointing to a malicious certificate they control. Because the library uses this untrusted certificate to verify the message's RSA signature, the attacker can successfully sign forged SNS payloads. This allows for the spoofing of Notification, SubscriptionConfirmation, and UnsubscribeConfirmation messages. The issue is fixed in version 2.3.5 by enforcing HTTPS and validating that the certificate host belongs to an AWS-owned SNS domain.
Affected products
- ex-aws ex_aws_sns >= 2.0.1, < 2.3.5
Timeline
- 2026-05-28: patched: Remediation developed and published to repository
- 2026-06-26: advisory: GitHub Advisory published