Spring Cloud AWS SNS Signature Verification Vulnerability

A vulnerability exists in Spring Cloud AWS versions 3.0.0 through 4.0.1, where applications using SNS HTTP/HTTPS endpoint support did not verify the signature of incoming SNS messages. This flaw allows an unauthenticated attacker who knows the endpoint URL to send crafted HTTP POST requests that mimic SNS Notification or SubscriptionConfirmation messages. As a result, the application could process these messages as legitimate, potentially leading to unauthorized confirmation of subscriptions or unsubscription from topics controlled by the attacker.

Impact

Exploitation of this vulnerability allows for the spoofing of SNS messages, enabling the processing of arbitrary payloads as if they were genuine notifications. Additionally, it could result in the unauthorized confirmation of subscriptions or unsubscription from topics managed by the attacker.

Remediation

Users should upgrade to Spring Cloud AWS version 4.0.2, where this vulnerability is fixed. For those on the 3.x line, a manual workaround is available by verifying the SNS message signature in a servlet filter or Spring HandlerInterceptor before the request reaches the controller, using the SnsMessageManager from the AWS SDK v2 sns-message-manager module.