PT-2023-31869 · Amazon · Aws Sdk For Php

Arkark · Published 2023-12-21 · Updated 2026-02-02 · CVE-2023-51651

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AWS SDK for PHP versions prior to 3.288.1

Description A URI path traversal issue exists in the AWS SDK for PHP, specifically within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot. This issue is possible due to the buildEndpoint method in the RestSerializer component relying on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed.

Recommendations Upgrade to the AWS SDK for PHP version 3.288.1 or later, if you are on a version prior to 3.288.1. As a temporary workaround, consider restricting access to S3 object keys and/or prefixes containing a Unix double-dot until the issue is resolved. Additionally, be cautious when using the buildEndpoint method in the RestSerializer component to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-51651

GHSA-557V-XCG6-RM5M

GHSA-73JG-4QH6-3F4G

GO-2026-4390

Affected Products

Aws Sdk For Php

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51651.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2023-51651.yaml · Exploit
• 🔥 https://github.com/ryotaromatsui/CVEs/tree/main/CVE-2025-69820 · Exploit
• https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2 · Patch
• https://osv.dev/vulnerability/GHSA-557v-xcg6-rm5m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51651 · Security Note
• https://ubuntu.com/security/CVE-2023-51651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69820 · Security Note
• https://osv.dev/vulnerability/GO-2026-4390 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51651 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73jg-4qh6-3f4g · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51651 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-51651 · Security Note
• https://github.com/aws/aws-sdk-php · Note
• https://github.com/aws/aws-sdk-php/security/advisories/GHSA-557v-xcg6-rm5m · Note