AI analysis
AWS Systems Manager Agent (SSM Agent) versions before 3.3.4851.0 on all platforms contain a server-side request forgery (CWE-918) in the port-forwarding-to-remote-hosts functionality, caused by improper validation of equivalent address representations (CWE-1289) when checking destination hosts against the remote destination denylist. An authenticated remote user with privileges to start an SSM Session Manager port-forwarding session can supply a crafted destination host value that expresses a denied link-local address in an alternate representation, bypassing the denylist and causing the agent to reach link-local endpoints such as the instance metadata service. From there, the attacker can potentially obtain the managed instance's temporary IAM role credentials and then act with that role's permissions from outside the instance, producing high confidentiality impact on the node and on downstream systems reachable with the role. The flaw affects any organization running affected SSM Agent versions on managed nodes, including EC2 instances, hybrid-activated on-premises servers, VMs and edge devices. No public proof-of-concept is known and the issue is not in the CISA KEV catalog, so no active exploitation is known at this time.
What to do: Upgrade SSM Agent to version 3.3.4851.0 or later on every managed node across all platforms (EC2 instances, hybrid-activated on-premises servers, VMs and edge devices), and inventory current agent versions via Systems Manager to find stragglers. As interim risk reduction, restrict IAM permissions for initiating Session Manager port-forwarding sessions and scope managed-instance IAM roles tightly so stolen role credentials have limited downstream access.
Affected
| Amazon Web Services (AWS) Systems Manager Agent (SSM Agent) | all versions before 3.3.4851.0, on all platforms |
Estimated exposure
masslikely millions of SSM-managed instances/nodes (SSM Agent ships by default in Amazon Linux and many AWS machine images) — SSM Agent is preinstalled on standard Amazon Linux AMIs and many AWS/public machine images and runs by default on EC2 instances and hybrid nodes enrolled in AWS Systems Manager, which AWS has publicly described as managing millions of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a managed instance and acting with that role's permissions from outside the instance, via a crafted destination host value that uses an alternate representation of a denied link-local address. To remediate this issue, users should upgrade to version 3.3.4851.0 or later.