Description

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten. To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T20:20:13.940Z",
  "pubdate": "2026-08-28T20:20:13.940Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the aws:downloadContent plugin of the amazon-ssm-agent. This security flaw stems from the improper limitation of pathnames to a restricted directory, allowing for arbitrary file writes on the host system.\nThe vulnerability affects amazon-ssm-agent versions prior to 3.3.4515.0. An authenticated remote attacker possessing ssm:SendCommand permissions specifically restricted to the AWS-DownloadContent document can exploit this flaw to overwrite sensitive files outside the intended download directory.\nSuccessful exploitation results in arbitrary code execution with root-level privileges, posing a severe risk to the integrity and confidentiality of the host environment. By leveraging crafted object keys within an S3 source, an attacker can manipulate the file system write operations performed by the agent.\nThe impact is significant, as it grants full system control upon successful overwriting of sensitive binaries or configuration files. Exploitation requires authenticated access to the AWS environment with the necessary SSM document permissions but does not require direct network access to the target host outside of the AWS infrastructure communication channels.",
  "technicalDetails": "The vulnerability originates from a validation deficiency in the aws:downloadContent plugin, which fails to adequately sanitize input parameters when handling S3 object keys. Specifically, the agent does not effectively enforce boundary constraints on file paths, allowing path traversal sequences (e.g., ../) to bypass intended directory restrictions.\nThe attack flow begins when a user invokes an ssm:SendCommand request utilizing the AWS-DownloadContent document. The attacker points the agent to a malicious S3 bucket containing objects with crafted keys designed to escape the target directory. When the amazon-ssm-agent processes these objects to download content, it performs a write operation to the file system using the malicious path.\nBecause the amazon-ssm-agent operates with root privileges, the file write operation is performed with the same elevated permissions. The agent fails to intercept the traversal characters, resulting in the agent writing files to arbitrary locations defined by the attacker-controlled S3 keys.\nExploitation allows an attacker to overwrite critical system configuration files, SSH authorized_keys, cron jobs, or executable binaries. By replacing a sensitive system binary or script with attacker-supplied malicious code, the attacker achieves arbitrary code execution (ACE) as the root user. This post-exploitation impact grants the attacker total control over the affected system, enabling persistence, data exfiltration, and lateral movement within the environment.\nThis vulnerability is specifically localized to the amazon-ssm-agent codebase versioning prior to 3.3.4515.0. It requires the attacker to be authenticated within the AWS environment and hold sufficient IAM permissions to trigger the AWS-DownloadContent document. There is no requirement for direct public network access to the agent; the interaction occurs through the managed SSM control plane. The agent’s lack of input sanitization during the file extraction phase from the S3 source is the primary vector for this unauthorized file system modification."
}