Executive brief
The AWS Encryption CLI is a command-line tool used to encrypt and decrypt data with AWS Key Management Service (KMS) keys. In affected versions, when strict mode was enabled to restrict decryption to a specific set of CMKs, the tool incorrectly allowed decryption using other authorized CMKs instead. An attacker with permission to decrypt using multiple CMKs could potentially decrypt data that should have been restricted to a subset of keys.
Technical details
The vulnerability is a configuration enforcement failure in the AWS Encryption CLI's strict mode implementation. When strict mode was specified, the CLI would incorrectly operate in "discovery mode", allowing it to decrypt data using any CMK the user had permission to use rather than only the explicitly configured CMKs. The flaw affects versions 1.7.x and 2.0.x of the aws-encryption-sdk-cli package. Although decryption still required the user to have valid permissions for at least one CMK, the attacker could bypass the intended CMK whitelist restriction. The vulnerability was patched in versions 1.8.x and 2.1.x with a breaking change that moved the discovery mode configuration from a CLI parameter to a wrapping-keys attribute.
Affected products
- Amazon Web Services (AWS) aws-encryption-sdk-cli 1.7.x, 2.0.x
Timeline
- 2020-10-28: disclosed
- 2020-10-27: patched