CVE-2025-23206: AWS CDK Information Disclosure Flaw

CVE-2025-23206 Overview

CVE-2025-23206 is an Improper Certificate Validation vulnerability in the AWS Cloud Development Kit (AWS CDK), an open-source software development framework used to define cloud infrastructure in code and provision it through AWS CloudFormation. The vulnerability exists in the IAM OIDC custom resource provider package, where the tls.connect method is configured with rejectUnauthorized: false, bypassing TLS certificate validation when downloading CA Thumbprints as part of the custom resource workflow.

This improper validation setting deviates from security best practices and introduces a potential attack surface for Man-in-the-Middle (MITM) attacks. While the issuer URL is provided by CDK users defining their applications, and the code executes within a Lambda environment which provides some mitigation against MITM attacks, the lack of proper certificate validation remains a security concern.

Critical Impact

Applications using the IAM OIDC custom resource provider may connect to potentially untrusted OIDC providers without proper TLS certificate validation, creating a possible attack vector for credential interception or MITM attacks in infrastructure-as-code deployments.

Affected Products

• Amazon AWS Cloud Development Kit versions prior to v2.177.0
• CDK applications using the IAM OIDC custom resource provider package
• Infrastructure deployments utilizing OIDC identity providers through CDK

Discovery Timeline

• 2025-01-17 - CVE CVE-2025-23206 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2025-23206

Vulnerability Analysis

The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature), specifically manifesting in the OIDC handler's TLS connection configuration. When CDK applications utilize the IAM OIDC custom resource provider, the handler downloads CA Thumbprints from OIDC provider endpoints. The underlying tls.connect implementation hardcodes rejectUnauthorized: false, effectively disabling TLS certificate chain validation.

This configuration allows connections to OIDC providers presenting invalid, expired, or self-signed certificates without raising errors or warnings. While the Lambda execution environment provides network isolation that reduces the practical exploitability of this flaw, the deviation from secure-by-default principles exposes users to potential risks when connecting to OIDC providers over untrusted networks or in compromised environments.

The fix requires enabling certificate validation via a feature flag to avoid breaking existing applications that may intentionally connect to non-standard OIDC providers.

Root Cause

The root cause is the explicit setting of rejectUnauthorized: false in the TLS connection options within the OIDC handler's external resource code. This configuration bypasses the Node.js TLS library's default certificate verification behavior, allowing connections to proceed regardless of certificate validity. The vulnerable code path can be found in the Custom Resource Handler.

Attack Vector

The attack vector is network-based, requiring an attacker to position themselves between the Lambda function and the OIDC provider endpoint. An attacker could potentially intercept the TLS connection and present a fraudulent certificate to capture or modify the OIDC thumbprint data. However, exploitation requires high privileges, active user interaction, and specific network positioning within the Lambda execution environment, significantly limiting practical attack scenarios.

The vulnerability mechanism involves the TLS connection to OIDC provider endpoints accepting any certificate without validation. This occurs during the CA Thumbprint retrieval process in the custom resource workflow. For detailed technical implementation, refer to the GitHub Issue #32920 and the Security Advisory.

Detection Methods for CVE-2025-23206

Indicators of Compromise

• Unexpected TLS connections from Lambda functions to unknown or unauthorized OIDC provider endpoints
• Modified or tampered CA Thumbprint values in IAM OIDC provider configurations
• Anomalous network traffic patterns during CDK deployment operations involving OIDC resources

Detection Strategies

• Audit CDK application code and cdk.context.json files for the presence and value of the @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections feature flag
• Review AWS CloudTrail logs for IAM OIDC provider creation and modification events with unexpected thumbprint values
• Monitor Lambda function execution logs for TLS connection warnings or errors during OIDC resource provisioning
• Implement network monitoring for Lambda VPC traffic to detect connections to suspicious OIDC endpoints

Monitoring Recommendations

• Enable enhanced logging for CDK deployments involving OIDC identity providers
• Configure CloudWatch alarms for unusual IAM OIDC provider activity
• Implement drift detection for IAM OIDC provider configurations to identify unauthorized thumbprint changes
• Review CDK version dependencies across projects to identify vulnerable deployments

How to Mitigate CVE-2025-23206

Immediate Actions Required

• Upgrade AWS CDK to version v2.177.0 or later
• After upgrading, enable the feature flag @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections in your cdk.context.json or cdk.json configuration
• Audit existing OIDC provider configurations for any suspicious or unexpected thumbprint values
• Review network security controls for Lambda functions interacting with external OIDC providers

Patch Information

The patch is available in AWS CDK version v2.177.0. The fix introduces a feature flag mechanism to enable proper TLS certificate validation while maintaining backward compatibility for existing deployments. For complete details, see the GitHub Security Advisory GHSA-v4mq-x674-ff73.

Workarounds

• No known workarounds are available for this vulnerability according to the security advisory
• Organizations unable to immediately upgrade should implement network-level controls to restrict Lambda egress traffic
• Consider using private VPC endpoints for OIDC provider communications where possible
• Manually verify CA Thumbprints after deployment until the patch can be applied

# Configuration example - Enable certificate validation after upgrading to v2.177.0
# Add to cdk.context.json or cdk.json:
{
  "context": {
    "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true
  }
}