A critical vulnerability in the AWS Systems Manager (SSM) Agent could allow unauthorized attackers to bypass Session Manager port-forwarding restrictions, access link-local services, and steal temporary IAM credentials assigned to Amazon EC2 instances This article explores vulnerability aws. . The vulnerability has been classified as critical by GitHub Security Advisory GHSA-w9jw-h72g-6hxc3, with a CVSS score of 7.5, indicating high network accessibility, low attack complexity, low privilege requirements, no user interaction, and significant impact.
This agent runs on managed AWS nodes and enables administrators and authorized users to establish remote management sessions without exposing SSH or RDP services directly to the internet. These addresses are particularly sensitive in AWS environments, as the EC2 Instance Metadata Service (IMDS) is typically accessible via link-local addresses, such as 169.254.169.254.
This flaw is categorized as CWE-918, or Server-Side Request Forgery, and CWE-1289, improper validation of unsafe equivalence in input. For instance, an instance profile with permissions to read Amazon S3 buckets, retrieve AWS Secrets Manager values, enumerate IAM resources, or access databases could provide an attacker with a broader avenue for cloud-account compromise. Organizations should upgrade affected managed nodes immediately and ensure that internally maintained forks or derivative implementations incorporate the fix.
Security teams should also review CloudTrail logs for unusual Session Manager activity, including remote-host port-forwarding sessions initiated by non-trusted users, roles, source IPs, or automation identities.
