Summary
exawssns: Trusted-attacker SigningCertURL permits complete SNS signature bypass
ExAws.SNS.verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own RSA key, and cause the function to return :ok, completely bypassing SNS signature verification.
Details
In lib/ex_aws/sns.ex (lines 475–483), verify_message/1 performs three checks: validate_message_params/1 (confirms required fields are present), validate_signature_version/1 (confirms SignatureVersion == "1"), then signature verification. The signature step calls ExAws.SNS.PublicKeyCache.get(message["SigningCertURL"]) and passes the result to :public_key.verify/4.
Neither validate_message_params/1 nor any other step checks that SigningCertURL is an HTTPS URL or that the hostname matches the expected pattern (e.g. sns.<region>.amazonaws.com). PublicKeyCache.get/1 in lib/ex_aws/sns/public_key_cache.ex fetches whatever URL is provided and caches the certificate. The RSA signature then verifies against the attacker's own public key, and verify_message/1 returns :ok.
PoC
- Generate an RSA keypair and host the DER/PEM public certificate at any URL reachable from the target server (e.g.
http://attacker.example/cert.pem). - Build a forged
Notificationpayload with an arbitraryTopicArnandMessage, compute the canonical string-to-sign per the SNS spec, and sign it with the attacker private key. - Set
SigningCertURLto the attacker URL andSignatureto the base64-encoded signature. - POST the forged payload to any SNS webhook endpoint that calls
ExAws.SNS.verify_message/1. - The function returns
:ok; the application treats the message as authentic.
Configurations
The application must expose an HTTP endpoint that calls ExAws.SNS.verify_message/1 on incoming request bodies (the standard SNS webhook pattern).
Resources
Impact
Complete SNS signature authentication bypass. Affects ex_aws_sns from 2.0.1 through 2.3.4. Consequences include spoofing arbitrary Notification payloads, auto-confirming attacker-controlled SubscribeURL values to hijack topic delivery, and spoofing UnsubscribeConfirmation to disrupt legitimate subscriptions. No authentication or special configuration on the attacker side is required. CVSS v4.0: 8.7 (HIGH).
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-47074? CVE-2026-47074 is a high-severity security vulnerability in ex_aws_sns (erlang), affecting versions >= 2.0.1, < 2.3.5. It is fixed in 2.3.5.
- Which versions of ex_aws_sns are affected by CVE-2026-47074? ex_aws_sns (erlang) versions >= 2.0.1, < 2.3.5 is affected.
- Is there a fix for CVE-2026-47074? Yes. CVE-2026-47074 is fixed in 2.3.5. Upgrade to this version or later.
- Is CVE-2026-47074 exploitable, and should I be worried? Whether CVE-2026-47074 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-47074 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-47074? Upgrade
ex_aws_snsto 2.3.5 or later.