Amazon S3 Encryption Client for Java < 4.0.0 Key Commitment (AWS-2025-032)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(282633);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/17");

  script_cve_id("CVE-2025-14763");
  script_xref(name:"IAVA", value:"2026-A-0003");

  script_name(english:"Amazon S3 Encryption Client for Java < 4.0.0 Key Commitment (AWS-2025-032)");

  script_set_attribute(attribute:"synopsis", value:
"A package installed on the remote host is affected by a cryptographic key commitment vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Amazon S3 Encryption Client for Java on the remote host is < 4.0.0. It is, therefore, 
affected by a key commitment vulnerability as referenced in the AWS-2025-032 advisory. 

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access 
to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored 
in an instruction file instead of S3's metadata record. 

Note that Nessus has not tested for this issues but has instead relied only on the application's 
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://aws.amazon.com/security/security-bulletins/AWS-2025-032/");
  script_set_attribute(attribute:"solution", value:
"Update Amazon S3 Encryption Client for Java to version 4.0.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14763");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:amazon:s3_encryption_client:java");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("s3_encryption_client_java_detect.nbin");
  script_require_keys("installed_sw/Amazon S3 Encryption Client for Java");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Amazon S3 Encryption Client for Java', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version': '4.0.0' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);