CVE-2025-23206 in aws-cdk
Summary
by MITRE • 01/17/2025
The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current `tls.connect` method will always set `rejectUnauthorized: false` which is a potential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in `cdk.context.json` or `cdk.json`. There are no known workarounds for this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/23/2026
The AWS Cloud Development Kit represents a critical infrastructure-as-code framework that enables developers to define cloud resources programmatically. When utilizing IAM OIDC custom resource provider packages within CDK applications, the framework downloads CA thumbprints as part of the custom resource workflow process. This particular vulnerability stems from the implementation of the tls.connect method which consistently sets rejectUnauthorized: false regardless of security considerations. The technical flaw creates a potential security risk by allowing unverified TLS connections that could be exploited in man-in-the-middle attacks, violating established security best practices for secure communication protocols.
The operational impact of this vulnerability extends beyond simple configuration issues as it affects the fundamental security posture of CDK applications that rely on OIDC authentication. While the advisory categorizes this as low severity due to the fact that the issuer URL is provided by CDK users who define their applications, the inherent risk remains significant. The security concern becomes more pronounced when considering that this code executes within Lambda environments which provide some mitigation against MITM attacks through their isolated execution contexts. However, this mitigation does not eliminate the core vulnerability and represents a dangerous default behavior that could be exploited in less secure deployment scenarios.
This vulnerability aligns with CWE-295 which addresses improper certificate validation and relates to the ATT&CK technique T1566.001 for credential access through phishing and social engineering. The implementation of a feature flag approach demonstrates a balanced security strategy that acknowledges the potential for breaking changes while providing organizations with the ability to enforce proper security controls. The recommended solution involves upgrading to CDK v2.177.0 where the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' must be explicitly set to true in either cdk.context.json or cdk.json configuration files. This approach allows for controlled migration and ensures that security improvements can be implemented without immediate disruption to existing deployments, while maintaining backward compatibility for organizations that require the legacy behavior.
The security implications of this vulnerability highlight the importance of secure coding practices in infrastructure-as-code frameworks. The AWS CDK team's decision to implement a feature flag rather than forcing an immediate breaking change demonstrates a mature approach to vulnerability management that balances security improvements with operational stability. Organizations should prioritize upgrading to the patched version and configuring the appropriate feature flag to ensure their CDK applications maintain proper TLS certificate validation. The lack of known workarounds underscores the necessity of implementing the recommended upgrade path and configuration changes to fully address this security concern.