CVE-2026-47074: ex_aws_sns SigningCertURL not validated in verify_message/1

Synopsis

Improper certificate validation in the ex_aws_sns Elixir library (ExAws.SNS versions 2.0.1 through before 2.3.5) allows an unauthenticated attacker to completely bypass SNS message signature verification. The vulnerability is reachable over the network with no authentication required: any attacker who can send an HTTP POST to an endpoint calling verify_message/1 can supply a self-controlled SigningCertURL, sign a forged SNS message with their own private key, and receive a passing :ok result from the verification function. Successful exploitation lets an attacker inject arbitrary SNS-formatted messages as if they were legitimately signed by AWS, enabling full integrity bypass of the SNS notification pipeline. A patched-image rebuild at version 2.3.5 (or commit 1853d280b152d10384a1e21a22cf22152a60be48) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send an HTTP POST request over the network to any endpoint in the target application that invokes verify_message/1.

• AuthenticationNot required

  No account, session, or credential of any kind is needed; the attack is fully unauthenticated.

• Victim interactionNot required

  No user or operator action is required; the attacker triggers the vulnerability entirely through their own network request.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker simply supplies a crafted SigningCertURL and a self-signed message payload, with no race conditions or special environmental state required.

Blast Radius

• The attacker injects arbitrary forged SNS messages that the application accepts as legitimate, bypassing all trust placed in AWS SNS as a message source.
• Any business logic gated on verified SNS notifications (subscription confirmations, event triggers, payment callbacks, provisioning webhooks) can be driven by attacker-controlled payloads.
• Data written to downstream stores or queues as a result of processed SNS messages can be corrupted or manipulated by the forged content.
• Integrity of the entire SNS-integrated notification pipeline is lost for the duration the vulnerable version is in use.