CVE-2025-14759: 
C# vulnerability analysis and mitigation

CVE-2025-14759 is a missing cryptographic key commitment vulnerability in the Amazon S3 Encryption Client (S3EC) for .NET, classified as a "Key Commitment Issue" enabling an "Invisible Salamanders" attack. It affects the NuGet package Amazon.Extensions.S3.Encryption versions 3.1.0 and earlier, and was disclosed on December 17, 2025. The vulnerability is part of a broader set of related CVEs (CVE-2025-14759 through CVE-2025-14764) affecting S3 Encryption Clients across multiple languages. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (AWS Security Bulletin, Github Advisory).

The root cause is the absence of cryptographic key commitment (CWE-327: Use of a Broken or Risky Cryptographic Algorithm) in the S3EC .NET library when the Encrypted Data Key (EDK) is stored in an "Instruction File" rather than S3's object metadata record. This design flaw enables the "Invisible Salamanders" attack (documented at https://eprint.iacr.org/2019/016), a known cryptographic weakness where a single ciphertext can be decrypted to two different plaintexts using different keys. An attacker requires two preconditions: (i) the ability to craft a rogue EDK that decrypts the target ciphertext to attacker-controlled plaintext, and (ii) write permission to the S3 bucket to replace the legitimate instruction file with one containing the rogue EDK. Subsequent decryption by legitimate clients will silently use the rogue EDK and produce the attacker-chosen plaintext (Github Advisory, AWS Security Bulletin).

Successful exploitation allows an attacker with low-privileged write access to an S3 bucket to silently substitute encrypted data keys, causing legitimate decryption operations to produce attacker-controlled plaintext without any error or alert. This results in a high integrity impact — data consumers receive manipulated content they believe to be authentic — while confidentiality and availability are not directly affected. The attack is particularly insidious because it is transparent to the decrypting application, potentially enabling undetected data manipulation in workflows that rely on S3-stored encrypted objects (Github Advisory, AWS Security Bulletin).

1. Reconnaissance: Identify target S3 buckets where the Amazon.Extensions.S3.Encryption NuGet package (version ≤ 3.1.0) is used for client-side encryption, and confirm that the "Instruction File" storage mode is enabled (EDKs stored as separate .instruction files rather than in S3 object metadata).
2. Obtain write access: Acquire low-privileged write permissions to the target S3 bucket (e.g., via compromised IAM credentials, overly permissive bucket policies, or insider access).
3. Craft rogue EDK: Using knowledge of the target encryption scheme and the "Invisible Salamanders" technique, construct a rogue Encrypted Data Key that, when used to decrypt the existing ciphertext, produces attacker-chosen plaintext instead of the original plaintext.
4. Replace instruction file: Upload a new instruction file to the S3 bucket, replacing the legitimate .instruction file associated with the target encrypted object. The instruction file now references the rogue EDK.
5. Trigger decryption: Wait for or induce a legitimate application using S3EC .NET to decrypt the target object. The client will silently use the rogue EDK, decrypting to the attacker-controlled plaintext without any error, completing the integrity compromise (Github Advisory, AWS Security Bulletin).

• S3 Access Logs: Unexpected PUT or PutObject API calls targeting .instruction files (objects with the .instruction suffix) in S3 buckets, especially from unfamiliar IAM principals or source IPs.
• S3 Access Logs: Modification timestamps on .instruction files that do not align with expected application write patterns or that postdate the original encrypted object creation.
• IAM/CloudTrail: PutObject events on instruction files from IAM users or roles that do not normally perform write operations on the bucket.
• Application Behavior: Decryption operations returning unexpected or inconsistent plaintext content compared to what was originally encrypted, without any decryption errors being raised by the S3EC library.

AWS has released patched versions of the Amazon S3 Encryption Client for .NET: version 3.2.0 adds decryption support for AES-GCM with key commitment (read compatibility), and version 4.0.0 or later enables both reading and writing messages with full key commitment. AWS recommends upgrading to version 4.0.0 or later for maximum protection. There are no known configuration-based workarounds — upgrading is the only remediation. Additionally, organizations should review and restrict write permissions on S3 buckets, audit existing bucket access policies, and monitor for unauthorized modifications to instruction files (AWS Security Bulletin, Github Advisory, Release Notes).

AWS published a formal security bulletin (AWS-2025-032) on December 17, 2025, addressing the full family of S3 Encryption Client key commitment issues across six languages. The advisory was noted by security community members on Mastodon (infosec.exchange) shortly after publication. The vulnerability was also tracked by Red Hat, Tenable, and vulnerability aggregators such as VulnDB and CVEFeed, indicating broad industry awareness. No significant controversy or notable researcher commentary beyond standard disclosure has been observed (AWS Security Bulletin).