CVE-2025-23206

Executive Summary

CVE-2025-23206 is a security advisory affecting the AWS Cloud Development Kit (AWS CDK), specifically the IAM OIDC custom resource provider package. The vulnerability arises from the tls.connect method within the custom resource workflow, which incorrectly sets rejectUnauthorized: false. This configuration disables TLS certificate validation, potentially allowing a man-in-the-middle (MITM) attack if an attacker can intercept the connection to the OIDC issuer. However, the advisory is marked as low severity because the issuer URL is provided by the CDK user, and the code runs in an AWS Lambda environment, which mitigates the risk of external MITM attacks. The patch is in progress, with an expected release in CDK v2.177.0. Users are advised to upgrade and enable the feature flag @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections to enforce certificate validation.

Supply Chain & Package Security

This vulnerability is specific to the AWS CDK, an open-source framework for defining cloud infrastructure. The affected component is the @aws-cdk/aws-iam package, which is distributed via npm. Users who include this package in their CDK applications are at risk if they rely on the default behavior. The supply chain risk is moderate, as the vulnerability is introduced by the package itself, not a third-party dependency. However, the fix requires a feature flag to avoid breaking changes, meaning users must actively opt-in to the secure behavior.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Low severity per advisory)
• Attack Vector (AV): Network (AV:N) – The vulnerability can be exploited over a network.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (C:L) – Potential exposure of CA thumbprints.
• Integrity (I): None (I:N) – No integrity impact.
• Availability (A): None (A:N) – No availability impact.
• Threat Level: Low – The attack requires the attacker to control the OIDC issuer or intercept the connection, which is mitigated by the Lambda environment.

Deep Dive & Mechanics

The vulnerability is in the IAM OIDC custom resource provider, which is used to create and manage IAM OIDC identity providers. During the custom resource workflow, the provider downloads CA thumbprints from the OIDC issuer. The code uses Node.js tls.connect to establish a TLS connection to the issuer, but it sets rejectUnauthorized: false, meaning the client does not validate the server's certificate. This allows an attacker who can perform a MITM attack to present a fake certificate and intercept the thumbprint data.

The advisory notes that the issuer URL is provided by the CDK user, so if a user intentionally connects to an unauthorized OIDC provider, CDK should not prevent it. Additionally, the code runs in an AWS Lambda function, which is isolated from external network attacks, reducing the likelihood of exploitation. The fix involves setting rejectUnauthorized: true by default, but this is a breaking change for existing applications that may rely on the current behavior. Therefore, a feature flag is introduced to allow users to opt-in to the secure behavior.

Vulnerable vs. Patched Code

Vulnerable Code (CDK < 2.177.0):

const tls = require('tls');
const socket = tls.connect(port, host, { rejectUnauthorized: false }, () => {
  // Download CA thumbprints
});

Patched Code (CDK >= 2.177.0 with feature flag enabled):

const tls = require('tls');
const socket = tls.connect(port, host, { rejectUnauthorized: true }, () => {
  // Download CA thumbprints
});

The patched code sets rejectUnauthorized: true, which enforces TLS certificate validation. The feature flag @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections controls this behavior. When set to true in cdk.context.json or cdk.json, the patched code is used.

Exploitation & Lab Setup

Red Team

To simulate exploitation, set up a rogue OIDC issuer with a self-signed certificate. Then, configure a CDK application to use this issuer as the IAM OIDC provider. The vulnerable code will connect to the rogue issuer without validating the certificate, allowing the attacker to intercept the thumbprint data.

Lab Setup:

1. Create a rogue OIDC issuer using a tool like mitmproxy or a custom Node.js server with a self-signed certificate.
2. Deploy a CDK application that uses the IAM OIDC custom resource provider, pointing to the rogue issuer.
3. Observe that the CDK application downloads the thumbprint without certificate validation.

Exploit Code (Node.js):

const tls = require('tls');
const fs = require('fs');

// Rogue server with self-signed certificate
const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem')
};

const server = tls.createServer(options, (socket) => {
  console.log('Client connected');
  socket.write('Fake thumbprint data');
  socket.end();
});

server.listen(443, () => {
  console.log('Rogue OIDC issuer listening on port 443');
});

Blue Team

To detect exploitation attempts, monitor for connections to unauthorized OIDC issuers. Use network monitoring tools to identify TLS connections with rejectUnauthorized: false or connections to unknown hosts. Additionally, enable the feature flag in CDK applications to enforce certificate validation.

Detection Steps:

1. Enable the feature flag @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections in all CDK applications.
2. Monitor CloudTrail logs for CreateOIDCProvider API calls with suspicious issuer URLs.
3. Use network flow logs to detect connections to unknown or untrusted OIDC issuers.

Indicators of Compromise (IOCs)

• Network: TLS connections to OIDC issuers with rejectUnauthorized: false in the TLS handshake.
• File: Presence of cdk.context.json or cdk.json with @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections set to false or missing.
• Log: CloudTrail events for CreateOIDCProvider with issuer URLs that do not match expected patterns.
• Process: Node.js processes using tls.connect with rejectUnauthorized: false.

Detection Engineering

YARA Rule

rule CVE_2025_23206_RejectUnauthorizedFalse {
    meta:
        description = "Detects vulnerable code with rejectUnauthorized: false in AWS CDK IAM OIDC provider"
        author = "Valters IT"
        date = "2025-02-22"
        cve = "CVE-2025-23206"
    strings:
        $s1 = "rejectUnauthorized: false" ascii wide nocase
        $s2 = "tls.connect" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-23206 - AWS CDK IAM OIDC RejectUnauthorized False
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects TLS connections with rejectUnauthorized: false in AWS CDK IAM OIDC provider
author: Valters IT
date: 2025-02-22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'rejectUnauthorized: false'
    condition: selection
falsepositives:
    - Legitimate use of self-signed certificates in development
level: low

Suricata Rule

alert tls any any -> any any (msg:"CVE-2025-23206 - AWS CDK IAM OIDC RejectUnauthorized False"; flow:to_server; tls.cert_issuer; content:"rejectUnauthorized: false"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade CDK: Upgrade to CDK v2.177.0 (expected release date 2025-02-22) or later.
2. Enable Feature Flag: Set @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections to true in cdk.context.json or cdk.json.
3. Monitor OIDC Providers: Review all IAM OIDC providers in your AWS account and ensure they use trusted issuers.
4. Network Segmentation: Ensure Lambda functions are in a VPC with controlled egress to prevent MITM attacks.
5. Audit CDK Applications: Scan CDK code for instances of rejectUnauthorized: false and update them.

Valters IT