CVE-2025-14761: AWS SDK for PHP S3 Encryption Client Key Commitment Issue
Summary
CVE-2025-14761: AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue. Affects aws/aws-sdk-php versions < 3.368.0. Fixed in 3.368.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS SDK for PHP is an open-source library that facilitates interaction with Amazon Web Services, particularly for managing S3 storage. The S3 Encryption Client (S3EC) is designed to provide client-side encryption for data stored in S3, ensuring that sensitive information is securely encrypted before being uploaded. However, a key commitment issue has been identified in versions up to 3.367.0, which could expose encrypted data keys to potential attacks.
Vulnerability Detail
The vulnerability arises from the S3EC's handling of encrypted data keys (EDKs) when stored in an 'Instruction File' rather than in S3's metadata. This oversight allows for an 'Invisible Salamanders' attack, where a malicious actor could replace the EDK with a rogue key, leading to unauthorized decryption of sensitive data. The lack of key commitment means that multiple EDKs can be associated with a single encrypted message, creating a significant security risk.
How To Fix
Minimum fixed version
3.368.0
This is the first release that contains the fix.
composer require aws/aws-sdk-php:3.368.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The only recommended action is to upgrade to the patched version of the AWS SDK for PHP.
Conclusion
The AWS SDK for PHP's S3 Encryption Client has a critical vulnerability related to key commitment, which could expose sensitive data to unauthorized access. Users are strongly advised to upgrade to version 3.368.0 or later to mitigate this risk.
See every vulnerability recorded for aws/aws-sdk-php →
FAQ
The vulnerability allows attackers to potentially replace encrypted data keys, leading to unauthorized access to sensitive information stored in S3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Key commitment is a cryptographic property that ensures an encrypted message can only be decrypted by the key that was used to encrypt it, preventing multiple keys from decrypting the same ciphertext.
Yes, failing to upgrade leaves your application vulnerable to attacks that could compromise sensitive data stored in S3.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for aws/aws-sdk-php.
