AWS Kiro Flaw Allowed Remote Code Execution via Malicious Web Pages

Vulnerability Overview

A security flaw in AWS's Kiro IDE allowed a malicious actor to manipulate Kiro’s configuration file and execute arbitrary code. The issue stemmed from Kiro's reliance on user approval for executing commands, which an attacker could bypass.

How the Attack Worked

Intezer's research revealed that the attack could occur when a developer requested Kiro to summarize content from a webpage. By embedding commands in hidden text on a webpage, the attacker could alter Kiro’s settings file (mcp.json), leading Kiro to run malicious code without the developer’s consent.

Specifically, Kiro can write to its configuration file through the fsWrite tool, which was exploited in this case.

Technical Mechanism

Kiro reads its external tool configuration from the mcp.json file located in the user's home directory. When this file changes, Kiro automatically reloads it, executing whatever commands are specified. This meant that a hidden command placed within web content could be executed upon reloading, putting the developer’s machine at risk.

Research Findings and Impact

The researchers demonstrated a proof of concept where the payload captured the machine’s hostname and username, sending this data back to the attacker. Although the execution may be inconsistent due to Kiro's non-deterministic nature, the potential for significant harm was evident, including risks like credential theft and unauthorized access to internal systems.

Despite being an isolated demo, the implications of this vulnerability highlight significant risks for developers using Kiro without awareness of such attacks.

Response and Mitigation

AWS has acted by patching the flaw, but the lack of a CVE may limit broader awareness within the industry. Developers using Kiro should ensure they are using the latest version and remain vigilant against possible attacks, emphasizing the importance of reviewing content from untrusted sources accurately.