IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

published 2025-01-17 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0113 , GHSA-v4mq-x674-ff73

cvss: 8.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current `tls.connect` method will always set `rejectUnauthorized: false` which is a potential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in `cdk.context.json` or `cdk.json`. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 2 links 3

npm aws-cdk-lib 2.177.0
amazon aws_cloud_development_kit 2.177.0

github.com/aws/aws-cdk@3e4f377 commit
github.com/aws/aws-cdk#32921 pull request
github.com/aws/aws-cdk/releases/tag/v2.177.0 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-17)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	1.8	CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CNA	4.0	1.8	CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	aws-cdk-lib	<2.177.0	2.177.0

Affected products

aws aws-cdk

Classification

Weakness

CWE-347 Improper Verification of Cryptographic Signature

References

github.com /aws/aws-cdk/pull/32921
web
github.com /aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9a
web
github.com /aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73
web, vendor-advisory
github.com /aws/aws-cdk/issues/32920
web, issue-tracking
docs.aws.amazon.com /cdk/v2/guide/featureflags.html
web
github.com /aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aw
web, product
github.com /aws/aws-cdk/releases/tag/v2.177.0
web
nvd.nist.gov /vuln/detail/CVE-2025-23206
advisory
github.com /aws/aws-cdk
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary