Listen to this Post
How the mentioned CVE works:
The AWS S3 Encryption Client for .NET (S3EC) facilitates client-side encryption for data stored in Amazon S3. In versions 3.1.0 and below, when the Encrypted Data Key (EDK) is stored in a separate “Instruction File” instead of the S3 object metadata, the encryption scheme lacks key commitment. Key commitment is a cryptographic property that binds the EDK to the ciphertext, ensuring that only the original encryption key can decrypt the message. Without it, the “Invisible Salamanders” attack allows a single ciphertext to be decrypted with different keys, producing different plaintexts. An attacker with write permissions to the S3 bucket can upload a rogue instruction file containing a malicious EDK. This EDK is crafted to decrypt the existing ciphertext to a plaintext chosen by the attacker. When the S3EC decrypts the object, it reads the rogue EDK from the instruction file, unwittingly using it to decrypt the ciphertext. This results in the attacker’s plaintext being produced, compromising data integrity and confidentiality. The attack requires the attacker to have bucket upload access and the ability to generate a compatible rogue EDK, exploiting the lack of key commitment in the encryption process.
dailycve form:
Platform: AWS S3EC
Version: <=3.1.0
Vulnerability: Key Commitment Lack
Severity: Critical
Date: 2023-03-28
Prediction: Patched 2023-03-28
What Undercode Say:
- aws s3 cp edk.txt s3://bucket/object.instruction
- aws s3 ls s3://bucket/ –recursive
- dotnet add package AWSSDK.S3Encryption
- File.WriteAllBytes(“instruction.file”, edk);
- var decryptor = new AmazonS3EncryptionClient();
How Exploit:
1. Acquire bucket write access.
2. Generate rogue EDK.
3. Upload malicious instruction file.
4. Victim decrypts with rogue EDK.
Protection from this CVE:
- Upgrade to version 4.0.0.
- Store EDK in metadata.
- Restrict bucket write permissions.
- Enable key commitment.
Impact:
- Data integrity loss.
- Unauthorized plaintext manipulation.
- Confidentiality breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
