Cross-Tenant Data Exfiltration in AWS Bedrock Agents via Manipulated Knowledge Base Documents
Overview
A high-severity vulnerability was identified in the AWS Bedrock Agents service, allowing for potential cross-tenant data exfiltration. The issue stemmed from improper handling of specially crafted documents ingested into a Knowledge Base for Bedrock. An attacker with the ability to control the content of a document (e.g., in a shared S3 bucket used as a data source) could embed Markdown image rendering syntax with a URL pointing to an external, attacker-controlled server. When another tenant's Bedrock Agent, configured to use this compromised Knowledge Base, retrieved and processed the document to synthesize a response, the Bedrock backend would attempt to render the Markdown. This process involved making an HTTP request to the attacker's URL. The attacker could craft this URL to include variables populated with sensitive data from the agent's context, such as parts of the user's prompt or data from other retrieved documents. While direct access to other tenants' data was not possible, this 'blind SSRF' attack allowed an attacker to exfiltrate sensitive information that the victim's agent was processing at that moment, leaking it via DNS lookups or GET requests to the attacker's server. Amazon's security team addressed the issue by implementing stricter parsing of retrieved documents and blocking outbound network requests during the response generation phase.
Affected Systems
Testing Guide
1. **Review Past Logs:** If you have detailed logs (e.g., VPC Flow Logs) for the Bedrock service's network activity, you could retrospectively search for unexpected outbound HTTP/DNS requests to unknown domains originating from AWS IP ranges associated with the Bedrock service. 2. **Current State:** As the vulnerability is patched by AWS, it is no longer possible to reproduce this specific attack vector. Testing should focus on ensuring your data sources remain secure.
Mitigation Steps
1. **No User Action Required:** AWS has patched this vulnerability on the service side. All users of AWS Bedrock Agents are protected. 2. **Audit Data Sources:** Regularly audit the permissions and integrity of data sources (e.g., S3 buckets) connected to your Bedrock Knowledge Bases. Ensure that only trusted entities can write or modify documents. 3. **Apply Principle of Least Privilege:** Use IAM policies to restrict the agent's access to only the specific data and AWS services it absolutely needs to function.
Patch Details
The vulnerability was mitigated by AWS on their backend infrastructure in June 2026. No client-side updates are needed.