Server-Side Request Forgery (SSRF) in AWS Bedrock Agents Web Search Tool
Overview
A critical Server-Side Request Forgery (SSRF) vulnerability was discovered in the built-in web search tool provided for agents in Amazon Bedrock. When an agent was configured to use this tool, it would fetch content from URLs provided either directly in the prompt or discovered during its web search. The vulnerability lay in the lack of validation for URLs pointing to internal AWS metadata services. An attacker could craft a prompt that tricks the agent into accessing the EC2 Instance Metadata Service (IMDS) endpoint, `http://169.254.169.254`. By chaining requests within the prompt, an attacker could instruct the agent to first fetch a session token and then use that token to query for IAM role credentials associated with the Bedrock service infrastructure. These exfiltrated credentials could grant the attacker permissions to other AWS services within the AWS internal production environment, potentially leading to cross-tenant data access or control over the Bedrock service itself. The attack could be initiated via an indirect prompt injection, where a malicious instruction is placed on a public webpage that the victim's agent is expected to browse. The vulnerability was responsibly disclosed by researchers at Wiz.io.
Affected Systems
Testing Guide
1. This vulnerability was patched on the AWS side. Any attempt to reproduce it on a currently configured Bedrock Agent should fail. 2. To test a custom tool, configure an agent to access a URL you control. 3. From that URL, attempt to redirect the agent to `http://169.254.169.254/latest/meta-data/`. 4. If the agent's response contains metadata from the underlying instance, your custom tool is vulnerable.
Mitigation Steps
1. AWS has deployed a patch globally, and no customer action is required to be protected. 2. For custom-built agent tools that fetch web content, ensure strict URL validation and network egress controls are in place. 3. Block access to local metadata services (e.g., 169.254.169.254) and other internal IP ranges. 4. Follow the principle of least privilege when assigning IAM roles to AI agent workloads.
Patch Details
AWS implemented a global network filter for the Bedrock service to block requests to the EC2 IMDS endpoint and other internal IP addresses. The patch was deployed transparently to all regions.