Full Report
Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents. The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42.
Analysis Summary
# Vulnerability: Prompt Injection in AWS AgentCore Harness Leading to Credential Exfiltration
## CVE Details
- **CVE ID**: N/A (Note: The research focuses on insecure default configurations and design patterns rather than a specific assigned CVE).
- **CVSS Score**: Estimated 8.2 (High)
- **CWE**: CWE-506 (Embedded Malicious Code), CWE-20 (Improper Input Validation)
## Affected Systems
- **Products**: AWS AgentCore (Harness/Framework) used for building LLM-based agents.
- **Versions**: All versions prior to the publication of hardening guidance.
- **Configurations**: Agents configured with "Default Tools" enabled, specifically those with access to environment variables, system information, or identity-linked metadata services (IMDS).
## Vulnerability Description
The vulnerability arises from the intersection of **Prompt Injection** and **excessive default tool permissions** within the AgentCore harness. By default, agents built with this framework may have tools enabled that allow the LLM to read local files, environment variables, or query the AWS Instance Metadata Service (IMDS).
An attacker can provide a malicious prompt to the agent (e.g., via a chat interface) that bypasses system instructions and commands the agent to use its internal tools to retrieve sensitive identity information—such as IAM role credentials, API keys, or session tokens—and exfiltrate them to an external endpoint controlled by the attacker.
## Exploitation
- **Status**: PoC available (demonstrated by Unit 42 research).
- **Complexity**: Low.
- **Attack Vector**: Network (Indirect Prompt Injection).
## Impact
- **Confidentiality**: **High**. Direct access to temporary security credentials and environment variables.
- **Integrity**: **Medium**. Potential for unauthorized AWS API calls using exfiltrated credentials.
- **Availability**: **Low**.
## Remediation
### Patches
- As this is a configuration-based architectural flaw, there is no single "patch." Users must update their implementation logic following AWS's latest security guidelines for Generative AI.
### Workarounds
- **Least Privilege**: Strip the agent’s IAM role of all permissions not strictly necessary for its function.
- **Tool Scoping**: Disable default tools that allow arbitrary file reads (`ls`, `cat`) or environment variable access.
- **IMDS Protection**: Enforce IMDSv2 and limit hop limits to prevent the agent from reaching the metadata service if not required.
- **Input Filtering**: Implement a robust guardrail layer (e.g., Amazon Bedrock Guardrails) to detect and block prompt injection attempts before they reach the LLM.
## Detection
- **Indicators of Compromise**:
- LLM audit logs showing unusual tool calls (e.g., calling `curl` or `wget` against `169.254.169.254`).
- Outbound network requests from the agent's compute environment to unknown or non-whitelisted external IPs.
- **Detection Methods**:
- Monitor CloudTrail for unusual IAM credential usage originating from IPs outside the expected VPC range.
- Analyze LLM application logs for "jailbreak" patterns or requests for environment/system data.
## References
- **Original Unit 42 Analysis**: hxxps[://]unit42[.]paloaltonetworks[.]com/securing-aws-agentcore-harness-credentials/
- **AWS Security Documentation**: hxxps[://]docs[.]aws[.]amazon[.]com/security/
- **OWASP Top 10 for LLMs**: hxxps[://]genai[.]owasp[.]org/llm-top-10/