AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration
A recent vulnerability in AWS Bedrock AgentCore Code Interpreter has been identified, allowing threat actors to bypass network isolation and establish covert command-and-control (C2) channels. Despite AWS's claims of complete isolation, researchers…
A recent vulnerability in AWS Bedrock AgentCore Code Interpreter has been identified, allowing threat actors to bypass network isolation and establish covert command-and-control (C2) channels. Despite AWS's claims of complete isolation, researchers discovered that the system permits outbound DNS queries for A and AAAA records, enabling data exfiltration and remote command execution without triggering network restrictions. This vulnerability has been assigned a CVSSv3 score of 7.5.
The AWS Bedrock AgentCore Code Interpreter facilitates the execution of dynamic code, such as Python or shell scripts, by AI agents and chatbots. Although the service utilizes Firecracker microVMs for compute isolation, the network layer in Sandbox mode does not restrict DNS traffic. If attackers execute code inside the interpreter through methods like prompt injection or supply chain attacks, they can exploit this flaw.
The attack involves polling a malicious DNS server, which sends commands encoded in DNS A record responses. The interpreter executes these commands and exfiltrates data via DNS subdomain queries, creating a hidden bidirectional tunnel within standard DNS traffic. This method can provide attackers with a full interactive reverse shell within an isolated environment, especially if the interpreter has an overprivileged AWS Identity and Access Management (IAM) role.
The AWS Bedrock AgentCore Code Interpreter facilitates the execution of dynamic code, such as Python or shell scripts, by AI agents and chatbots.
Researchers demonstrated potential abuse of IAM permissions to access other AWS services, such as S3 buckets or DynamoDB. Through the DNS C2 channel, attackers can list storage buckets, read files, and extract sensitive information like PII, API keys, and financial data. Traditional network monitoring tools may not detect this breach due to its use of DNS queries.
Mitigation and Security Recommendations
AWS has opted not to patch the sandbox behavior but has updated its documentation to indicate that Sandbox mode allows DNS resolution. Security teams should take proactive steps to secure AI deployments. It is recommended that organizations inventory all active AgentCore Code Interpreter instances and evaluate their network configurations.
To ensure network isolation, migrating workloads handling sensitive data to "VPC Mode" is advised. This configuration requires VPC endpoints and allows administrators to enforce strict network ACLs and Route53 DNS Firewalls. Furthermore, enforcing the principle of least privilege by ensuring the Code Interpreter's IAM role has only the necessary permissions is crucial to prevent unauthorized access to sensitive resources.
Based on reporting by GBHackers.