Empty-ciphertext panic in aws-encryption-provider

A researcher reported a vulnerability in the official Kubernetes KMS plugin kubernetes-sigs/aws-encryption-provider. Just two bytes in a Decrypt request with an empty Cipher field can trigger a panic because the code access request.Cipher[0] without checking the field length. As a result, the plugin crashes, and while it restarts, kube-apiserver cannot encrypt new Secrets or decrypt existing ones.

Key points: 📌 The issue can be triggered through the plugin's local Unix socket 📌 It affects both V1 (plugin.go:179) and V2 (plugin_v2.go:182)

The issue was reported to AWS VDP via HackerOne. Fix:

if len(request.Cipher) == 0 {
    return nil, errors.New("invalid empty ciphertext")
}.```

📎 Article: https://syntetisk.tech/blog/posts/empty-ciphertext-panic-in-aws-encryption-provider-cvd-with-aws/