CVE-2020-36363
📋 TL;DR
This CVE identifies that AWS CloudFront's TLSv1.2_2019 security policy includes CBC-mode ciphers (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) that are considered cryptographically weak due to potential padding oracle attacks. Any AWS CloudFront distribution using the TLSv1.2_2019 security policy is affected. This could allow attackers to decrypt TLS traffic between clients and CloudFront.
💻 Affected Systems
- AWS CloudFront
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could decrypt sensitive data transmitted between clients and CloudFront distributions, potentially exposing authentication tokens, session cookies, API keys, and other confidential information.
Likely Case
Targeted decryption of specific TLS sessions to extract sensitive information, particularly in environments where attackers can observe and manipulate network traffic.
If Mitigated
Minimal impact if proper monitoring and traffic analysis are in place to detect unusual decryption attempts, though the cryptographic weakness remains.
🎯 Exploit Status
Exploitation requires network position to intercept TLS traffic and cryptographic analysis capabilities. No public exploit code has been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A (configuration change required)
Vendor Advisory: https://aws.amazon.com/about-aws/whats-new/2020/07/cloudfront-tls-security-policy/
Restart Required: No
Instructions:
1. Log into AWS Management Console. 2. Navigate to CloudFront. 3. Select your distribution. 4. Go to 'Behaviors' tab. 5. Edit the behavior. 6. Change 'Viewer Protocol Policy' to use TLSv1.2_2021 or later security policy. 7. Save changes.
🔧 Temporary Workarounds
Update CloudFront Security Policy via AWS CLI
allChange CloudFront distribution security policy to TLSv1.2_2021 using AWS CLI
aws cloudfront update-distribution --id YOUR_DISTRIBUTION_ID --distribution-config file://config.json
🧯 If You Can't Patch
- Implement additional encryption layer (e.g., application-level encryption) for sensitive data
- Monitor network traffic for unusual decryption patterns and implement WAF rules to detect padding oracle attacks
🔍 How to Verify
Check if Vulnerable:
Check CloudFront distribution configuration in AWS Console or using AWS CLI: aws cloudfront get-distribution-config --id YOUR_DISTRIBUTION_ID | grep SecurityPolicyCheck Version:
aws cloudfront get-distribution-config --id YOUR_DISTRIBUTION_ID | grep -A5 -B5 SecurityPolicyVerify Fix Applied:
Verify the security policy shows TLSv1.2_2021 or later in CloudFront distribution configuration📡 Detection & Monitoring
Log Indicators:
- Unusual TLS handshake failures
- Multiple TLS renegotiation attempts
- Padding oracle attack patterns in TLS logs
Network Indicators:
- Abnormal CBC cipher usage patterns
- TLS session decryption attempts
- Man-in-the-middle attack signatures
SIEM Query:
source="cloudfront" AND (cipher_suite="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" OR cipher_suite="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384")