AWS SDK for PHP URI Path Traversal Vulnerability in S3 Component

A URI path traversal vulnerability has been identified in the AWS SDK for PHP, specifically in version 3 prior to 3.288.1. The issue arises in the 'buildEndpoint' method of the RestSerializer component, where requests to S3 object keys or prefixes containing a Unix double-dot can lead to arbitrary object access. This vulnerability exists because the 'buildEndpoint' method uses the Guzzle Psr7 UriResolver utility, which removes dot segments from the request path according to RFC 3986. Under certain conditions, this can be exploited to access unintended objects.

Impact

Exploitation of this vulnerability allows for URI path traversal, potentially leading to unauthorized access of S3 objects.

Reproduction

To reproduce this vulnerability, send a request to S3 object keys or prefixes that include a Unix double-dot. The 'buildEndpoint' method will improperly handle the dot segments, allowing access to arbitrary objects.

Remediation

Upgrade to AWS SDK for PHP version 3.288.1 or later.