Code Injection in AgentCore CLI

Executive Summary

This vulnerability involves improper neutralization of triple-quote characters during Python code generation in AgentCore CLI versions before 0.14.2.

An authenticated remote attacker can exploit this flaw by crafting a malicious collaborationInstruction stored on a Bedrock Agent collaborator.

When another user in the same AWS account imports this agent, the malicious code is processed and executed under the imported agent's IAM execution role and on the local environment of that user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated remote attacker to execute arbitrary code on the AWS AgentCore Runtime with the permissions of the imported agent's IAM execution role.

It can also lead to code execution on the local environment of another user within the same AWS account, potentially compromising sensitive data and system integrity.

The impact includes full confidentiality, integrity, and availability compromise as indicated by the high CVSS scores.

Useful 0 Not Useful 0

Mitigation Strategies

To remediate this vulnerability, users should upgrade to version 0.14.2 of AgentCore CLI.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime and on the local environment of another user within the same AWS account. This code execution can occur under the imported agent's IAM execution role, potentially exposing sensitive data or allowing unauthorized actions.

Such unauthorized code execution and potential data exposure could impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and access. The ability for an attacker to execute arbitrary code with elevated permissions may lead to breaches of protected data or unauthorized system modifications, thereby violating these regulatory requirements.

To mitigate these risks and maintain compliance, users are advised to upgrade to the fixed version 0.14.2, regenerate and redeploy affected agents, and inspect generated code for malicious content if immediate upgrading is not possible.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you should first check the version of the AWS AgentCore CLI installed. Versions between 0.4.0 and 0.14.1 (including preview versions 0.3.0-preview.7.0 to 1.0.0-preview.8) are vulnerable.

You can run the following command to check the installed version of the AgentCore CLI:

• npm list -g @aws/agentcore

If you find a vulnerable version, inspect the generated main.py file of any imported Bedrock supervisor agents for suspicious triple-quote sequences ("""), especially in the collaborationInstruction field. Look for any unescaped triple-quote characters that could indicate attempted code injection.

A manual inspection command example (on Unix-like systems) to find triple-quote sequences in main.py files could be:

• grep -n '\"\"\"' path/to/agent/main.py

If such sequences are found, it may indicate exploitation or attempted exploitation of the vulnerability.

To remediate, upgrade the CLI to version 0.14.2 or later, remove affected agents, regenerate main.py files with the patched CLI, and redeploy.

Useful 0 Not Useful 0