CVE-2020-8911

CBC padding oracle in AWS S3 Crypto SDK for GoLang

Severity Score

5.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

Se presenta una vulnerabilidad de tipo padding oracle en AWS S3 Crypto SDK para GoLang versiones anteriores a la versión V2. El SDK permite a los usuarios cifrar archivos con AES-CBC sin calcular un Message Authentication Code (MAC), que entonces permite a un atacante que tiene acceso de escritura al depósito S3 del objetivo y puede observar si un endpoint con acceso a la clave puede descifrar un archivo, pueden reconstruir el texto plano con (en promedio) consultas 128*length (en texto sin formato) al endpoint, aprovechando la capacidad de CBC para manipular los bytes del siguiente bloque y los errores de relleno de PKCS5. Se recomienda actualizar su SDK a la versión V2 o posterior y volver a cifrar sus archivos

A flaw was found in the AWS S3 Crypto SDK that allows users to encrypt files stored in S3 buckets with AES-CBC, without computing a MAC on the data. This allows for a padding oracle, enabling attackers with both write access to the target S3 bucket and the ability to observe the result of valid decryption attempts to potentially recover original plaintext. This is not an issue if files in S3 buckets are not encrypted with CBC mode, which is disabled in V2 of the AWS S3 Crypto SDK.

*Credits: Sophie Schmieg

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-02-12 CVE Reserved
2020-08-11 CVE Published
2023-12-15 EPSS Updated
2024-08-04 CVE Updated
2024-08-04 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://github.com/google/security-research/security/advisories/GHSA-f5pg-7wfw-84q9	2024-08-04

URL	Date	SRC

URL	Date	SRC
https://aws.amazon.com/blogs/developer/updates-to-the-amazon-s3-encryption-client/?s=09	2020-08-18
https://access.redhat.com/security/cve/CVE-2020-8911	2021-10-14
https://bugzilla.redhat.com/show_bug.cgi?id=1869800	2021-10-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Amazon Search vendor "Amazon"		Aws S3 Crypto Sdk Search vendor "Amazon" for product "Aws S3 Crypto Sdk"				< 2.0 Search vendor "Amazon" for product "Aws S3 Crypto Sdk" and version " < 2.0"		golang		Affected