The vulnerability stems from the ExAws.SNS module fetching the signing certificate from the SigningCertURL field of an incoming SNS message without verifying that the URL uses HTTPS or that the host belongs to an AWS-owned SNS domain. An attacker who can POST to any endpoint that calls ExAws.SNS:verify_message/1 can supply a forged SigningCertURL pointing to a certificate they control, sign a counterfeit SNS message with their own key, and cause the function to return :ok. This bypasses the intended signature verification and allows the attacker to have arbitrary messages accepted by the application, effectively spoofing AWS SNS notifications and potentially triggering unintended actions.

The affected product is ex-aws ex_aws_sns, spanning all releases from version 2.0.1 up through any release before 2.3.5. No other vendors or product variants are listed as affected.

The CVSS score of 8.7 indicates a high severity flaw with significant impact on confidentiality, integrity, and availability. The EPSS score is not available, which leaves the exact exploit probability uncertain, but the flaw is exploitable by any unauthenticated actor who can post to a verified endpoint, making the attack path relatively straightforward. The vulnerability is not listed in CISA's KEV catalog, yet the high severity and lack of host validation support a strong likelihood of real-world exploitation if left unaddressed.