Cross-Tenant Data Exfiltration via SSRF in AWS Bedrock Model Customization
Overview
Security researchers at Trail of Bits disclosed a critical Server-Side Request Forgery (SSRF) vulnerability in the AWS Bedrock service, specifically within the data import functionality for model fine-tuning. To fine-tune a model, users provide a URI to a dataset stored in an S3 bucket. The vulnerability stemmed from insufficient validation of the provided S3 URI. An attacker could craft a malicious URI that, instead of pointing to a legitimate S3 object, resolved to internal AWS service endpoints, such as the EC2 metadata service (169.254.169.254). When the Bedrock service processed this malicious URI, it would make a request to the internal endpoint. This allowed the attacker to retrieve temporary IAM credentials from the service role used by the Bedrock backend. These credentials possessed elevated privileges within the AWS internal network, potentially granting the attacker access to the service's control plane and internal data stores. The researchers demonstrated that these stolen credentials could be leveraged to access and exfiltrate sensitive data, including proprietary fine-tuning datasets and conversation logs from other AWS customers using the same service, effectively breaking tenant isolation. The vulnerability highlighted the risks associated with services that process user-supplied URLs in a privileged cloud environment.
Affected Systems
Testing Guide
1. This vulnerability was on the AWS server side and cannot be tested by customers. 2. Review historical AWS CloudTrail logs for your account to check for any unusual `CreateFineTuningJob` API calls with suspicious `training_file` URIs prior to the patch date.
Mitigation Steps
1. This vulnerability was patched by AWS on their backend. No user action is required for mitigation. 2. As a best practice, always use IAM policies that follow the principle of least privilege for data sources (e.g., S3 buckets) used for model fine-tuning. 3. Enable AWS CloudTrail and GuardDuty to monitor for anomalous API calls or access patterns related to your AI services.
Patch Details
AWS patched the vulnerability on their backend infrastructure in June 2026. All customer instances are protected automatically.