CVE-2022-31159
📋 TL;DR
A partial-path traversal vulnerability in AWS SDK for Java v1 allows attackers to write S3 bucket contents outside the intended destination directory when using the downloadDirectory method. This affects Java applications that download from untrusted S3 buckets using vulnerable SDK versions. The issue is limited to directory names matching the destination prefix.
💻 Affected Systems
- AWS SDK for Java
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file write to parent directories, potentially leading to system compromise, data exfiltration, or denial of service through critical file overwrites.
Likely Case
Unauthorized file writes to adjacent directories, potentially exposing sensitive data or disrupting application functionality.
If Mitigated
Limited impact with proper bucket trust controls and validation, restricting writes to intended directories only.
🎯 Exploit Status
Requires attacker control over S3 object keys and application downloading from untrusted bucket.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.261
Vendor Advisory: https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3
Restart Required: Yes
Instructions:
1. Update AWS SDK for Java dependency to version 1.12.261 or later. 2. Update pom.xml or build.gradle to reference new version. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
KeyFilter workaround
allImplement a KeyFilter that rejects S3 object keys containing '..' substring
KeyFilter filter = summary -> !summary.getKey().contains("..");
TransferManager tm = new TransferManager(s3Client);
MultipleFileDownload download = tm.downloadDirectory(bucketName, keyPrefix, destinationDir, filter);
🧯 If You Can't Patch
- Only download from trusted S3 buckets with controlled object keys
- Implement additional validation of S3 object keys before passing to downloadDirectory()
🔍 How to Verify
Check if Vulnerable:
Check if application uses AWS SDK for Java v1 <1.12.261 and calls TransferManager.downloadDirectory() with potentially untrusted S3 buckets.Check Version:
mvn dependency:tree | grep aws-java-sdk OR gradle dependencies | grep aws-java-sdkVerify Fix Applied:
Verify AWS SDK version is 1.12.261+ and test downloadDirectory with malicious '..' keys to confirm rejection.📡 Detection & Monitoring
Log Indicators:
- Failed file writes outside expected directories
- S3 download operations with unusual key patterns
Network Indicators:
- Unexpected S3 download patterns from untrusted sources
SIEM Query:
source="application_logs" AND ("downloadDirectory" OR "TransferManager") AND (".." OR "path traversal")