In-band Key Negotiation Vulnerability in AWS S3 Crypto SDK for GoLang
Summary
CVE-2020-8912: In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- github.com/aws/aws-sdk-go · ghsa
The same CVE-2020-8912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS S3 Crypto SDK for GoLang, part of the AWS SDK for Go, provides developers with tools to encrypt and decrypt data stored in Amazon S3. This SDK allows for secure data handling by implementing various encryption algorithms. However, vulnerabilities in its key negotiation process can lead to significant security risks, particularly when an attacker has write access to the targeted S3 bucket.
Vulnerability Detail
A vulnerability exists in the in-band key negotiation process of the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to a targeted S3 bucket can manipulate the encryption algorithm of an object, switching from AES-GCM to AES-CTR. This change, when combined with a decryption oracle, can expose the authentication key used by AES-GCM, as decrypting the GMAC tag reveals the authentication key through an algebraic equation. This vulnerability can lead to unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that only trusted users have write access to your S3 buckets. Additionally, consider implementing additional security measures such as monitoring access logs and using IAM policies to restrict permissions.
Conclusion
The in-band key negotiation vulnerability in the AWS S3 Crypto SDK for GoLang poses a significant risk to data security. It is crucial for developers using this SDK to update to version V2 or later to mitigate this risk. Implementing strict access controls and monitoring can also help protect against potential exploitation.
See every vulnerability recorded for github.com/aws/aws-sdk-go →
FAQ
The vulnerability allows an attacker with write access to change the encryption algorithm of objects in an S3 bucket, potentially exposing sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive data stored in S3, as the authentication key can be revealed.
Yes, updating to version V2 or later of the AWS SDK for Go addresses this vulnerability.
If an immediate update is not possible, restrict write access to your S3 buckets and monitor access logs for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/aws/aws-sdk-go.
