Security researchers recently disclosed a significant vulnerability in Amazon’s EC2 Simple Systems Manager (SSM) Agent that could have allowed attackers to achieve privilege escalation and execute arbitrary code with root permissions.
The flaw, which was patched in early March 2025, highlights the importance of proper input validation in cloud management tools.
The Vulnerability Explained
The security flaw resided in the ValidatePluginId function within the pluginutil.go file of the AWS SSM Agent GitHub repository.
This function failed to properly sanitize input, allowing attackers to supply malicious plugin IDs containing path traversal sequences like “../” when creating SSM documents.
Under normal operation, the plugin ID is used as a directory name where the agent creates and executes a _script.sh file with root privileges, typically within the directory /var/lib/amazon/ssm/INSTANCE_ID/document/orchestration/.
However, due to the flawed validation, an attacker could manipulate the plugin ID to traverse the filesystem and execute scripts in unauthorized locations.
“This allows the SSM Agent to create directories and eventually execute scripts in unintended locations on the filesystem.
Such arbitrary directory creation could be exploited for privilege escalation or other malicious activities,” explained researchers from Cymulate, who discovered the vulnerability.
Exploitation Path
An attacker exploiting this vulnerability could:
- Create a malicious SSM document with a plugin ID containing path traversal sequences (e.g., “../../../../../../malicious_directory”)
- Upload the document to their AWS account using the AWS Management Console, CLI, or SDK[3]
- Execute the document via the SSM Agent
- The SSM Agent would then create directories in unintended locations and execute scripts with root privileges
In a proof-of-concept, researchers demonstrated that when a malicious plugin ID was used, the SSM Agent created directories in unexpected locations like /tmp/ instead of the intended orchestration directory, with scripts then executing with elevated privileges.
AWS Response and Remediation
Following responsible disclosure on February 12, 2025, AWS acknowledged the issue on February 20 and released a patch on March 5, 2025, with SSM Agent version 3.3.1957.0.
According to the release notes, AWS implemented a “BuildSafePath method to prevent path traversal in orchestration directory”.
This update properly validates and sanitizes plugin IDs, rejecting any input containing special characters that could enable path traversal attacks.
Background on SSM Agent
The AWS Systems Manager Agent is a critical component that enables administrators to remotely manage and configure EC2 instances, edge devices, on-premises servers, and virtual machines.
It processes commands defined in SSM Documents, which are JSON or YAML-based templates that specify actions to be executed on target systems.
SSM Agent processes requests from the Systems Manager service in the AWS Cloud and then runs them as specified, sending status and execution information back to the service using the Amazon Message Gateway Service.
Organizations using SSM Agent should update to version 3.3.1957.0 or later to protect against this vulnerability.
AWS offers automatic update capabilities that can be configured through the Systems Manager console to ensure instances always run the latest, most secure version of the agent.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The flaw, which was patched in early March 2025, highlights the importance of proper input validation in cloud management tools.){kind=link}