AWS Systems Manager Agent (SSM Agent) versions prior to 3.3.4851.0 contain a server-side request forgery vulnerability in the Session Manager port forwarding feature. The flaw arises from improper validation of equivalent address representations, allowing an authenticated user with port-forwarding permission to bypass the remote destination denylist. This enables access to link-local endpoints, potentially exposing the managed instance's temporary IAM role credentials. Exploitation could allow an attacker to act with the permissions of the instance's IAM role from outside the instance. AWS has fixed this vulnerability in SSM Agent version 3.3.4851.0 and recommends upgrading. As a temporary mitigation, restricting the use of the relevant SSM document by limiting IAM permissions is advised.

An authenticated user with port-forwarding permission can bypass security controls to access link-local endpoints on the managed instance. This may lead to exposure of temporary IAM role credentials associated with the instance, allowing the attacker to perform actions with those permissions externally. This elevates the risk of unauthorized access and privilege escalation within AWS environments using vulnerable SSM Agent versions.

Upgrade AWS Systems Manager Agent to version 3.3.4851.0 or later, which contains the official fix for this vulnerability. Until the upgrade is applied, restrict the use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping IAM permissions (ssm:StartSession) and SSM document permissions to prevent untrusted principals from initiating remote-host port-forwarding sessions.