CVE-2025-23206
📋 TL;DR
AWS CDK's IAM OIDC custom resource provider has a TLS certificate validation vulnerability where it accepts unauthorized connections. This allows potential man-in-the-middle attacks against OIDC provider communications. Only users of AWS CDK's IAM OIDC custom resource provider are affected.
💻 Affected Systems
- AWS Cloud Development Kit (AWS CDK)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept and manipulate OIDC provider communications, potentially compromising IAM role trust relationships and gaining unauthorized AWS access.
Likely Case
Limited impact due to Lambda environment isolation and user-controlled OIDC provider URLs, but could enable credential theft in targeted attacks.
If Mitigated
With proper TLS validation enabled, all unauthorized connections are rejected, preventing MITM attacks.
🎯 Exploit Status
Exploitation requires man-in-the-middle position between CDK Lambda and OIDC provider, plus knowledge of specific CDK deployments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CDK v2.177.0 (expected release 2025-02-22)
Vendor Advisory: https://github.com/aws/aws-cdk/issues/32920
Restart Required: No
Instructions:
1. Upgrade to CDK v2.177.0 or later. 2. Set feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' to true in cdk.context.json or cdk.json. 3. Redeploy CDK applications.
🔧 Temporary Workarounds
No workarounds available
allAWS states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Monitor OIDC provider connections for unusual activity or certificate warnings
- Consider temporarily disabling IAM OIDC custom resource usage if not essential
🔍 How to Verify
Check if Vulnerable:
Check if using AWS CDK IAM OIDC custom resource provider and version is below v2.177.0Check Version:
cdk --versionVerify Fix Applied:
Verify CDK version is v2.177.0+ and feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true📡 Detection & Monitoring
Log Indicators:
- Lambda execution logs showing TLS certificate validation failures or warnings
- CloudTrail logs showing unusual IAM OIDC provider modifications
Network Indicators:
- Unusual network traffic patterns between Lambda functions and OIDC providers
- Certificate validation failures in network monitoring
SIEM Query:
source:cloudtrail AND (eventName:AssumeRoleWithWebIdentity OR eventName:UpdateAssumeRolePolicy) AND errorCode:*🔗 References
- https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html
- https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34
- https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560
- https://github.com/aws/aws-cdk/issues/32920
- https://github.com/aws/aws-cdk/pull/32921
- https://github.com/aws/aws-cdk/releases/tag/v2.177.0
- https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73
