A flaw in Amazon's agent development environment allows attacker-controlled repository content to route the agent and exfiltrate sensitive information to an external server.
Mindguard researchers have detailed a vulnerability of Amazon Kiro's ADI enabling the exfiltion of data by quick injection via the Kiro Powers mechanism. The flaw, without CVE ID, has been demonstrated on version 0.7.45 on Windows, while the current version of the tool is 1.0.337.
The operating scenario requires two actions from the user: Open the project trapped by a workspace file, via File → Open Workspace From File instead of simply opening the folder, then send any message to the agent. What makes the case notable is that the victim does not need to submit malicious instructions, or to designate the content controlled by the attacker.
Once these conditions are met, sensitive data from the workspace can go to an external termination point without the user asking Kiro to access or transmit them. The difficulty of operation is considered low.
Read the full article on the original source
Go to the source →