CVE-2024-45037

Executive Summary

CVE-2024-45037 is an authorization bypass vulnerability in the AWS Cloud Development Kit (CDK), specifically affecting the RestApi construct when used with CognitoUserPoolAuthorizer and authorization scopes. Under certain conditions, authenticated Amazon Cognito users may gain broader access to API resources than intended, potentially leading to unauthorized data disclosure and modification. The vulnerability impacts CDK versions 2.142.0 through 2.148.0. A patch is available in version 2.148.1, and users are advised to upgrade and re-deploy their applications.

Supply Chain & Package Security

This vulnerability resides in the AWS CDK, an open-source framework distributed via npm (as aws-cdk-lib). Organizations using CDK to define cloud infrastructure should verify their package.json or cdk.json for affected versions. The supply chain risk is moderate, as the vulnerability is introduced during infrastructure deployment and can be remediated by updating the CDK library and re-deploying stacks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated Cognito user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access but can lead to unauthorized access to API resources, potentially exposing sensitive data or allowing modifications.

Deep Dive & Mechanics

The AWS CDK RestApi construct with CognitoUserPoolAuthorizer allows developers to restrict API access to authenticated Cognito users and optionally limit access using authorization scopes. The vulnerability arises from improper validation of authorization scopes during the generation of the CloudFormation template. Specifically, when scopes are defined, the CDK may fail to correctly enforce them in the generated AWS::ApiGateway::Authorizer or AWS::ApiGateway::Method resources, resulting in a broader permission set than intended.

Root Cause: The CDK’s logic for translating authorization scopes into CloudFormation resource properties contains a flaw that omits or misconfigures scope constraints under certain conditions (e.g., when multiple scopes are combined or when the authorizer is reused across methods). This allows authenticated Cognito users with any valid token to access methods that should require specific scopes.

Impact: An attacker with a valid Cognito token (e.g., from a compromised user account or a misconfigured user pool) can access API endpoints that should be restricted to users with specific scopes. This could lead to data exfiltration, unauthorized writes, or privilege escalation within the application.

Vulnerable vs. Patched Code

Vulnerable (CDK 2.142.0 - 2.148.0):

// Example CDK code that may be vulnerable
const api = new apigateway.RestApi(this, 'MyApi');
const auth = new apigateway.CognitoUserPoolAuthorizer(this, 'MyAuthorizer', {
  cognitoUserPools: [userPool],
});
api.root.addMethod('GET', new apigateway.MockIntegration(), {
  authorizer: auth,
  authorizationScopes: ['read:data'], // Scope may not be enforced
});

Patched (CDK >=2.148.1):

// After upgrading CDK, the same code correctly enforces scopes
const api = new apigateway.RestApi(this, 'MyApi');
const auth = new apigateway.CognitoUserPoolAuthorizer(this, 'MyAuthorizer', {
  cognitoUserPools: [userPool],
});
api.root.addMethod('GET', new apigateway.MockIntegration(), {
  authorizer: auth,
  authorizationScopes: ['read:data'], // Now properly enforced
});

The patch ensures that the generated CloudFormation template includes the correct AuthorizationScopes property on the AWS::ApiGateway::Method resource, preventing scope bypass.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An AWS account with CDK deployed application using vulnerable version.
• A valid Cognito user token (e.g., from a test user or compromised account).

Steps:

1. Identify the API endpoint protected by CognitoUserPoolAuthorizer with scopes.
2. Obtain a Cognito JWT token (e.g., via aws cognito-idp admin-initiate-auth).
3. Send a request to the API endpoint without the required scope in the token:

   curl -H "Authorization: Bearer <JWT_TOKEN>" https://api-id.execute-api.region.amazonaws.com/prod/resource
   

4. If the request succeeds (HTTP 200) when it should fail (HTTP 403), the vulnerability is present.

Exploit Code (Python):

import requests
import boto3

# Assume token obtained from Cognito
token = "eyJraWQiOiJ..."

url = "https://api-id.execute-api.region.amazonaws.com/prod/resource"
headers = {"Authorization": f"Bearer {token}"}

response = requests.get(url, headers=headers)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Blue Team

Detection:

• Monitor CloudTrail logs for UpdateMethod or CreateMethod API calls with missing or incorrect authorizationScopes.
• Use AWS Config rules to check that API Gateway methods have AuthorizationScopes set when using Cognito authorizers.

Mitigation:

• Immediately upgrade CDK to version 2.148.1 or later.
• Re-deploy all affected stacks.
• Review existing API Gateway configurations for scope misconfigurations.

Indicators of Compromise (IOCs)

• CloudTrail Events: UpdateMethod or CreateMethod with authorizationScopes missing or set to an empty list.
• API Gateway Method Configuration: Methods using CognitoUserPoolAuthorizer without AuthorizationScopes property.
• Logs: Successful API calls (HTTP 200) to endpoints that should require specific scopes, from users without those scopes.

Detection Engineering

YARA Rule

rule CVE_2024_45037_CDK_Scope_Bypass {
    meta:
        description = "Detects CDK-generated CloudFormation templates missing authorization scopes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45037"
    strings:
        $s1 = "CognitoUserPoolAuthorizer" nocase
        $s2 = "AuthorizationScopes" nocase
        $s3 = "AWS::ApiGateway::Method" nocase
    condition:
        $s1 and $s3 and not $s2
}

Sigma Rule

title: CVE-2024-45037 - CDK Cognito Authorization Scope Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CloudTrail events where API Gateway methods are created or updated without authorization scopes when using Cognito authorizer.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45037
logsource:
    service: cloudtrail
    product: aws
detection:
    selection:
        eventSource: "apigateway.amazonaws.com"
        eventName:
            - "UpdateMethod"
            - "CreateMethod"
        requestParameters.authorizationScopes: null
    condition: selection
falsepositives:
    - Intentional configuration without scopes
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45037 - Cognito Scope Bypass Attempt"; flow:to_server; content:"Authorization"; nocase; http_header; content:"Bearer"; distance:0; within:100; pcre:"/^Bearer\s+[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade AWS CDK to version 2.148.1 or later:

   npm install aws-cdk-lib@^2.148.1
   

2. Re-deploy all affected stacks:

   cdk deploy --all
   

Long-term:

• Implement CI/CD pipeline checks to enforce CDK version requirements.
• Use AWS Config rules to monitor API Gateway authorizer configurations.
• Conduct regular security reviews of IAM and Cognito policies.

Workaround: If immediate upgrade is not possible, manually verify and correct the AuthorizationScopes property in the generated CloudFormation template before deployment.

Valters IT
DevSecOps & Cyber Threat Intelligence