CDK custom resource CustomCDKBucketDeployment: SecurityHub HIGH notification: CVE-2023-43804 - Python urllib3

[Rick-Ernsting]

Describe the bug

In SecurityHub we get a HIGH severity notification "CVE-2023-43804 - urllib3" with message:

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

We get this notification when the CDK custom resource CustomCDKBucketDeployment is deployed by CDK. Can you update urllib3 to a version which is not vulnerable?

Expected Behavior

That we get no SecurityHub notification

Reproduction Steps

When we deploy this:

const elevatedPrivilegesTrail = new Trail(this, 'ElevatedPrivilegesTrail', {
      trailName: props.envContext.elevatedPrivilegesTrailName,
      bucket: elevatedPrivilegesTrailBucket,
      encryptionKey: elevatedPrivilegesTrailKey,
      sendToCloudWatchLogs: true,
      cloudWatchLogGroup: new LogGroup(this, 'ElevatedPrivilegesTrailLogGroup', {
        logGroupName: 'LZElevatedPrivilegesTrail',
        retention: RetentionDays.SIX_MONTHS,
      }),
    })
    elevatedPrivilegesTrail.addEventSelector(
      DataResourceType.LAMBDA_FUNCTION,
      [invokeElevatedPrivilegesFn.functionArn],
      { includeManagementEvents: false },
    )

We then see the SecurityHub HIGH notification: CVE-2023-43804 - Python urllib3

Possible Solution

Upgrade Python urllib library

Additional Information/Context

No response

CDK CLI Version

2.96.2

Framework Version

No response

Node.js Version

18.16.0

OS

Windows

Language

TypeScript, Python

Language Version

TypeScript 5.1.3

Other information

No response

[indrora]

@aws/aws-cdk-maintainers

[vinayak-kukreja]

Taking a look into replicating this issue.

[netvolart]

I have the same problem. Critical security report for a bunch of Custom Resources.
CVE-2023-45803 - urllib3
CVE-2023-43804 - urllib3

Recommended mitigation by AWS inspector:
Update urllib3 to 2.0.7

[vinayak-kukreja]

Critical security report for a bunch of Custom Resources

Hey @volkovartem , could you please tell us which resources are you seeing these for? Also what cdk version are you using right now?

[vinayak-kukreja]

Hey @Rick-Ernsting , I tried replicating with the code you mentioned but that does not create CustomCDKBucketDeployment. Could you please provide some reproduction steps?

And could you also share what your security hub setup looks like? Is there any integrations that are adding to the findings?

• Reason I ask is that to replicate CustomCDKBucketDeployment, I am deploying,

       const websiteBucket = new Bucket(this, 'Test-WebsiteBucket', {
         websiteIndexDocument: 'index.html',
         publicReadAccess: false,
       });
   
       new BucketDeployment(this, 'Test-DeployWebsite', {
         sources: [Source.asset('./website-dist')],
         destinationBucket: websiteBucket,
         destinationKeyPrefix: 'web/static',
       });
  

  and this right now is not showing a urllib3 finding.

[vinayak-kukreja]

Can confirm, I see CVE-2023-43804 - urllib3 using aws-s3-deployment in Amazon Inspector. Investigating more.

[vinayak-kukreja]

Hey, we have merged in the update. It would make it into the next cdk release 2.106.0.

Keeping this issue open to confirm if that release resolves the issue for you.

[Rick-Ernsting]

Hello Vinayak,
Thank you.
Cheers, Rick

[netvolart]

Thank you, guys!

[vinayak-kukreja]

Hey apologies, there was an issue after merging this in the pipeline. I am actively looking into it and will update here with the progress.

[vinayak-kukreja]

Hey, thank you for your patience. :)

We have released it as part of our most recent update: https://github.com/aws/aws-cdk/releases/tag/v2.106.0. Please let me know if you still see a security hub notification after updating to this version.

[Rick-Ernsting]

Hello Vinayak. Thank you for the update. I see that the urllib3 library is updated to a version which doesn't contain the CVE-2023-43804 problem. I updated and deployed my stacks and saw that the security hub/inspector notification disappeared.
Thank you for your support.
Cheers! Rick

[Rick-Ernsting]

Closed

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.