CVE-2021-40828

AWS IoT Device SDK v2 (Java, Python, C++, Node.js) TLS hostname verification issue on Windows

• CVSS 8.8
• CWE-295 Improper Certificate Validation
• Memory Corruption
• Remote

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

CVE

CVE-2021-40828

CWE

CWE-295 Improper Certificate Validation

CVSS base score

8.8

Published

2021-11-23

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Use-After-Free Errors

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update AWS IoT Device SDK to the specified versions or higher.

import os
import ssl
import socket

def create_connection(endpoint, port, ca_cert_path):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to path traversal
    context = ssl.create_default_context()
    
    context.load_verify_locations(cafile=ca_cert_path)

    context.check_hostname = False

    with socket.create_connection((endpoint, port)) as sock:
        with context.wrap_socket(sock) as insecure_sock:
            print("Connection established to:", insecure_sock.version())

if __name__ == "__main__":
    endpoint = "your-iot-endpoint.amazonaws.com"
    port = 8883 
    ca_cert_path = os.path.join(os.path.dirname(__file__), 'path/to/ca-cert.pem')

    create_connection(endpoint, port, ca_cert_path)

import os
import ssl

def create_connection(endpoint, port, ca_cert_path):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents path traversal
    context = ssl.create_default_context()

    context.load_verify_locations(cafile=ca_cert_path)

    context.check_hostname = True

    with socket.create_connection((endpoint, port)) as sock:
        with context.wrap_socket(sock, server_hostname=endpoint) as secure_sock:
            print("Connection established to:", secure_sock.version())

if __name__ == "__main__":
    endpoint = "your-iot-endpoint.amazonaws.com"
    port = 8883 
    ca_cert_path = os.path.join(os.path.dirname(__file__), 'path/to/ca-cert.pem')

    create_connection(endpoint, port, ca_cert_path)

@misc{vaitp:cve202140828,
  title        = {{AWS IoT Device SDK v2 (Java, Python, C++, Node.js) TLS hostname verification issue on Windows}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-40828},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-40828/}}
}