DEVOURED
Global S3: Another C2 Channel for AgentCore Code Interpreters
AgentCore code interpreter sandboxes can be exploited via S3 as a bidirectional command and control channel using buckets and presigned URLs, despite prior DNS exfiltration fixes.
What: Sonrai Security research demonstrates that AgentCore's code interpreter, even after DNS exfiltration mitigations, remains vulnerable to S3-based command and control (C2). Attackers can leverage S3 buckets and presigned URLs to establish a reverse shell within the sandbox, using the cloud storage service for bidirectional communication.
Why it matters: This reveals a persistent and nuanced challenge in securing AI agent sandboxes, where seemingly innocuous features like cloud storage access can be repurposed for sophisticated C2 channels, highlighting the need for deeper policy enforcement beyond network-level restrictions.
Takeaway: If you manage environments with AI code interpreters that have S3 access, implement strict VPC mode configurations and granular S3 gateway endpoint policies to prevent their use as covert C2 channels.
Deep dive
- Sonrai Security research identified a new command and control (C2) channel vulnerability in AgentCore code interpreter sandboxes.
- The vulnerability leverages S3 access, which can be abused for bidirectional communication.
- This bypasses previous mitigations for DNS exfiltration in code interpreters.
- Attackers can create S3 buckets and use presigned URLs to facilitate a reverse shell within the sandbox environment.
- The S3 channel allows both sending commands to the compromised interpreter and receiving output from it.
- This poses a significant risk for data exfiltration and further compromise of cloud resources.
- Mitigations include deploying the code interpreter in a Virtual Private Cloud (VPC) with restricted egress.
- Strict S3 gateway endpoint policies are also recommended to limit access only to necessary S3 resources.
- The research highlights the sophisticated methods attackers use to circumvent sandbox protections in AI environments.
Decoder
- AgentCore: An AI system that includes a code interpreter, likely running in a sandbox environment, which is the target of the described vulnerability.
- Sandbox: An isolated computing environment where programs can be run without affecting the surrounding system, typically used for untrusted code or security testing.
- S3 (Amazon Simple Storage Service): A widely used object storage service provided by Amazon Web Services (AWS).
- Command and Control (C2) channel: A covert communication pathway used by attackers to remotely control compromised systems and exfiltrate data.
- Presigned URL: A URL generated by an AWS account that grants temporary, limited-time access to a specific S3 object without requiring AWS credentials.
- Reverse shell: A shell session initiated from a target machine back to an attacker's machine, often used for remote control and command execution.
- DNS exfiltration: A technique where attackers use DNS queries to transmit small amounts of data out of a restricted network.
- VPC (Virtual Private Cloud): A private, isolated section of a cloud provider's network where users can launch AWS resources in a virtual network they define.
- S3 gateway endpoint: A gateway that allows private access from a VPC to S3 without requiring an internet gateway, VPN connection, or AWS Direct Connect.
Original article
Full article content is not available for inline reading.
Explore all 68 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi