Executive brief
The AWS Encryption SDK for JavaScript (used to encrypt and decrypt sensitive data) allows plaintext from signed messages to be released before the ECDSA signature is validated. In streaming mode, an attacker with KMS decrypt permissions could potentially encrypt messages without proper signature validation, compromising non-repudiation guarantees. This affects integrity assumptions for applications relying on cryptographic signatures to prove message authenticity.
Technical details
The vulnerability is an improper verification of cryptographic signatures (CWE-347) in the streaming decryption mode of the AWS Encryption SDK JavaScript. The root cause is that in streaming mode, the SDK releases plaintext to callers before the ECDSA signature is fully validated, allowing an actor with trusted KMS decrypt permissions to potentially encrypt messages. Although AES-GCM encryption ensures ciphertext and decrypted plaintext integrity, the delayed ECDSA signature validation weakens non-repudiation. The vulnerability is network-reachable for applications using the streaming API with signed messages. Patches are available in versions 1.9.0 and 2.2.0; affected versions are all prior to 1.9.0 and 2.0.0 through 2.1.x. Workarounds include reading streams to completion before processing plaintext or using the non-streaming API for signed messages.
Affected products
- AWS @aws-crypto/client-browser < 1.9.0; >= 2.0.0, < 2.2.0
- AWS @aws-crypto/client-node < 1.9.0; >= 2.0.0, < 2.2.0
Timeline
- 2021-05-27: disclosed
- 2021-06-01: patched: Fixed in versions 1.9.0 and 2.2.0