AWS SDK for Ruby CVE-2025-14762

Three concrete conditions must all hold: (1) the application uses the AWS SDK for Ruby S3 Encryption Client (aws-sdk-s3 gem) at version <= 1.207.0 for client-side encryption; (2) EDKs are stored using the optional 'Instruction File' mode rather than S3 object metadata - this is the specific feature that lacks key commitment; and (3) the attacker already possesses write (PutObject) permission on the target S3 bucket to overwrite the instruction file, plus the ability to construct a rogue EDK that decrypts the existing ciphertext to desired plaintext (CVSS AT:P). Deployments using metadata-stored EDKs, or without an attacker holding bucket write access, are not exploitable. There are no workarounds other than upgrading to 1.208.0 or later.

This is a genuine but low-urgency, highly conditional cryptographic weakness, not a high-priority alarm. The vendor CVSS 4.0 vector (6.0, AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) correctly scores it as an integrity-only issue (VI:H) with no confidentiality or availability impact - the attacker swaps in a rogue encrypted data key so a victim later decrypts attacker-chosen plaintext. Note AT:P (attack requirement 'present') and PR:L: the attacker must already hold write permission to the S3 bucket and the deployment must use the optional 'Instruction File' EDK-storage mode, plus must craft a rogue EDK that validly decrypts the object - a non-trivial precondition set. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit code is identified; the Invisible Salamanders class attack is academically well-documented (eprint.iacr.org/2019/016) but no weaponized PoC against this gem is published. Signals are consistent: moderate CVSS driven by integrity impact, low EPSS, no KEV - this is a real but narrow defense-in-depth fix, prioritized for anyone using S3EC Instruction File mode rather than an emergency. One labeling conflict: the input Tag 'Information Disclosure' contradicts the vector (VC:N, VI:H), so this should be classed as a data-integrity/tampering issue, not disclosure.

An attacker who already has write access to an S3 bucket that stores client-side-encrypted objects using the Ruby S3 Encryption Client in 'Instruction File' mode crafts a rogue encrypted data key that still decrypts the existing ciphertext to a plaintext of their choosing. They upload a replacement instruction file; when the legitimate application next reads the object, S3EC uses the rogue EDK and silently returns the attacker-controlled plaintext. No public exploit code exists, though the underlying 'Invisible Salamanders' technique is published research.