AWS Cognito Multi-Region Replication Auth Failover Design Flaw and Health Check Analysis

Summary of Vulnerability Information Vulnerability Overview Type: Design flaw in the authentication and failover mechanism within the AWS Cognito Multi-Region Replication architecture. Core Issues: - After enabling Multi-Region Replication, synchronization of User Pools between the Primary Region and the Replica Region relies on health checks and routing logic. - When the Primary Region becomes unavailable, traffic should automatically switch to the Replica Region; however, the failover logic depends on the health status of the and the control of the request header. - If health checks fail or the routing logic malfunctions, authentication requests may not be routed correctly, resulting in service disruption or authentication failures. Impact Scope Affected Services: - AWS Cognito (User Pools, authentication, token issuance) - AWS Lambda (for triggers, pre-checks, and cross-region synchronization) - AWS WAF (Web Access Control, used to intercept unexpected traffic) - CloudWatch (monitoring and alerting) - Route 53 (DNS routing and health checks) Affected Scenarios: - Cognito MRR (Multi-Region Replication) in multi-region deployments - Authentication flows dependent on Cognito (e.g., SAML, OIDC, API Key) - Execution of Failover strategies Remediation 1. Configure Symmetric Multi-Region Cognito User Pools: - Ensure that the Cognito User Pool configurations in the Primary Region and the Replica Region are consistent (e.g., OIDC settings, keys, policies, etc.). - Use the resource definition to ensure cross-region synchronization. 2. Enable and Monitor Health Checks: - Configure Route 53 health checks to monitor the Cognito endpoints in the Primary Region. - Set up CloudWatch alarms to trigger failover when health checks fail. 3. Configure WAF and Lambda Triggers: - Use WAF to intercept unexpected traffic, ensuring that only legitimate requests reach Cognito. - Configure Lambda triggers to execute synchronization and validation logic during region switching. 4. Perform Failover via SDK or API: - Manually or automatically switch traffic to the Replica Region using the AWS SDK or API. - Ensure the request header is correctly set to control the routing destination. 5. Monitoring and Alerting: - Use CloudWatch to monitor the health status of Cognito endpoints. - Set alarm thresholds to automatically trigger failover when health checks fail. POC / Exploitation Code

Goal Reached Thanks to every supporter — we hit 100%!

AWS Cognito Multi-Region Replication Auth Failover Design Flaw and Health Check Analysis