CVE-2023-51651: 
PHP vulnerability analysis and mitigation

AWS SDK for PHP, prior to version 3.288.1, contains a URI path traversal vulnerability (CVE-2023-51651) discovered in December 2023. The vulnerability exists in the buildEndpoint method within the RestSerializer component, which incorrectly handles requests to S3 object keys and/or prefixes containing Unix double-dot segments (GitHub Advisory).

The vulnerability stems from the buildEndpoint method's reliance on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. This behavior, combined with certain conditions, could lead to unauthorized access to arbitrary objects. The issue has been assigned a CVSS v3.1 score of 6.0 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, indicating local access requirements but potential for high impact on confidentiality and integrity (GitHub Advisory).

The vulnerability could allow attackers to access arbitrary objects through path traversal techniques when handling S3 object keys or prefixes containing double-dot segments. This could potentially lead to unauthorized access to sensitive data and compromise of data integrity (GitHub Advisory).

The vulnerability has been patched in AWS SDK for PHP version 3.288.1. Users are strongly advised to upgrade to version 3.288.1 or later to address this security issue (AWS Release, GitHub Advisory).