OS command injection in AWS REX setup-guide SSM documents allows arbitrary command execution
Documents made from an AWS example setup let attackers run commands on servers!
Summary
SSM documents (Rex-RO and Rex-RW) created from the example script in the AWS Trusted Remote Execution (REX) setup guide have an OS command injection issue. An authenticated user permitted to invoke them can run arbitrary commands as root on the managed instance; shipped REX artifact versions are not affected.
Affected when
- Rex-RO or Rex-RW SSM documents created by following the setup guide's example script
- An authenticated user permitted to invoke those documents
What to do
Delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and region where it was run. No code patch exists; the example was removed from the guide.
Products and platforms
CVE IDs
Sources
- Advisory: aws.amazon.com (opens in a new tab)
- Write-up: github.com (opens in a new tab)
Times
First published
First seen