Threat actors have exploited a critical remote code execution vulnerability in the Marimo notebook platform to steal AWS credentials and gain access to an SSH bastion host within eight seconds This article explores authentications bastion. . This attack was documented by the Sysdig Threat Research Team and leveraged a pre-authentication remote code execution flaw in Marimo versions up to and including 0.20.4.
Marimo is an open-source reactive Python notebook platform commonly used by developers, data scientists, and machine-learning teams. This compromise can provide attackers with valuable access to sensitive environments, including datasets, API tokens, and development tools. Researchers revealed that the endpoint failed to properly enforce authentication checks, allowing an attacker to establish a WebSocket connection and gain an interactive shell as the user running the Marimo process.
Teams frequently deploy notebook servers quickly for experimentation, but they might retain access to AWS services, source code, datasets, model-provider credentials, and internal systems. Security teams must identify public-facing Marimo deployments, disable or secure unnecessary terminal endpoints, and ensure WebSocket services require authentication. Monitoring should focus on unusual Secrets Manager requests, unexpected credential use, new SSH authentications to bastion hosts, and rapid sequences of cloud API activity following application access.
The demonstration highlights that a human-controlled intrusion can swiftly execute a full exploit-to-lateral-movement chain within seconds when cloud credentials and privileged secrets are easily accessible.
