Summary
AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0 were susceptible to
information leakage (an attacker could create ciphertexts that would leak the user’s AWS account ID,
encryption context, user agent, and IP address upon decryption), ciphertext forgery (an attacker could
create ciphertexts that were accepted by other users) and lack of robustness (an attacker could create
ciphertexts that decrypt to different plaintexts for different users).
Affected Services
KMS
Remediation
Update the SDK to the latest secure version.
Tracked CVEs
CVE-2020-8897
References
https://twitter.com/XorNinja/status/1310587707605659649https://vnhacker.blogspot.com/2020/09/advisory-security-issues-in-aws-kms-and.html
Contributed by https://github.com/0xdabbad00
Disclosure Date
Mon, Sep 28th, 2020
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Thai Duong (thaidn), Google
