AWS Systems Manager Plugin Vulnerability Let Attackers Execute Arbitrary Code

In a demonstrated exploit, an attacker could set the plugin name in an SSM document to a path traversal string such as ‘../../../../../../malicious_directory’. When this document is executed, the SSM Agent erroneously creates directories in unintended locations, such as the /tmp directory. The vulnerability emerges from a lack of rigorous validation that permits attackers to manipulate these plugin IDs, resulting in unauthorized file creation and script execution with root privileges. Successful exploitation could allow attackers to create directories in unintended locations, execute arbitrary scripts with root privileges, and potentially escalate privileges by writing files to sensitive areas of the system. The vulnerability, stemming from improper input validation within the ValidatePluginId function, affects a core component used to manage EC2 instances and on-premises servers across AWS environments worldwide. This function fails to properly sanitize user inputs on plugin IDs, allowing attackers to include malicious path traversal sequences such as ‘../’ in the plugin ID. “The SSM Agent is a crucial component for remotely managing and configuring EC2 instances and on-premises servers,” explains the security advisory. Cloud administrators are urged to enforce proper input validation and maintain vigilant monitoring for unusual system behaviors to protect sensitive data and ensure system integrity. According to Cymulate’s report, the vulnerability resides in the ValidatePluginId function within the pluginutil.go file in the official AWS SSM Agent GitHub repository. For organizations using AWS SSM Agent, immediate remediation through patching is critical to mitigate potential exploitation attempts, as adversaries continue to target cloud infrastructure with increasingly sophisticated techniques. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This resolves to a location where a _script.sh file is generated and executed with root privileges, potentially enabling privilege escalation and system compromise. “Add and use BuildSafePath method to prevent path traversal in the orchestration directory,” stated the release notes published by AWS on GitHub.

This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 09 Apr 2025 08:00:13 +0000