-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aws/aws-sdk-php | composer | < 3.368.0 | 3.368.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a key commitment issue within the AWS SDK for PHP's S3 Encryption Client, specifically when using the 'Instruction File' metadata storage strategy. The root cause is that the encryption metadata, including the Encrypted Data Key (EDK), was stored in a separate S3 object (the instruction file) without any cryptographic binding to the actual encrypted content.
An attacker with s3:PutObject permissions could exploit this by replacing the legitimate instruction file with a malicious one containing a rogue EDK. When a user subsequently attempts to decrypt the data via getObject, the following vulnerable workflow is triggered:
Aws\S3\Crypto\InstructionFileMetadataStrategy::load is called to retrieve the encryption metadata. It reads the attacker-controlled instruction file from S3.Aws\Crypto\DecryptionTraitV2::decrypt function.decrypt function, lacking key commitment validation in affected versions, proceeds to use the attacker's key to decrypt the ciphertext. This allows the attacker to control the resulting plaintext output, a vulnerability known as an 'Invisible Salamanders' attack.The patch addresses this by introducing S3EncryptionClientV3, which implements key commitment. For V3 objects, critical metadata, including a key commitment hash, is stored in the main S3 object's headers, not the instruction file. The decryption process now involves deriving a commitment key from the original content encryption key and verifying it against the stored hash, ensuring the integrity of the key and preventing this attack.
Aws\S3\Crypto\InstructionFileMetadataStrategy::loadsrc/S3/Crypto/InstructionFileMetadataStrategy.php
Aws\Crypto\DecryptionTraitV2::decryptsrc/Crypto/DecryptionTraitV2.php
Aws\S3\Crypto\InstructionFileMetadataStrategy::savesrc/S3/Crypto/InstructionFileMetadataStrategy.php