aws-samples / aws-samples/aws-device-lobby
Commissioner Lambda creates target policies with iot:Connect on client/* (wildcard client ID)
Open
- Dominant language
- JavaScript
- Stars
- 22
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
Location:
commissioner.js
var thingpolicy = {
"Statement": [
{ "Effect": "Allow", "Action": ["iot:Connect"], "Resource": "arn:aws:iot:" + region + ":" + accountId + ":client/*" },
...
]
};
The policy created in target accounts allows connection with ANY client ID. A compromised device can impersonate other devices by connecting with their client IDs, potentially hijacking their sessions.
Fix: Use the thing name as client ID restriction:
"Resource": "arn:aws:iot:" + region + ":" + accountId + ":client/${iot:Connection.Thing.ThingName}"
Contributor guide
Assessment
This issue has not been assessed yet.