Executive Summary: Cross-Task Credential Hijacking in Amazon ECS

Amazon Web Services (AWS) has resolved a critical privilege escalation and credential boundary breakdown vulnerability within the Amazon Elastic Container Service (Amazon ECS) Container Agent. The flaw impacted EC2 launch-type container instances hosting multiple co-located ECS tasks belonging to different microservices or organizational tenants.

In Amazon ECS, tasks access temporary AWS security credentials through IAM Roles for Tasks. Instead of querying the EC2 Instance Metadata Service (IMDS at 169.254.169.254), containers query the specialized ECS Task Metadata Endpoint (accessible at 169.254.170.2). The vulnerability allowed a malicious or compromised container with standard, unprivileged access to exploit a race condition during network namespace provisioning, effectively intercepting the metadata traffic intended for adjacent tasks or querying the host EC2 instance profile directly.

Architectural Breakdown: How ECS Isolates Task Credentials

When an ECS task starts on an EC2 instance, the ECS Agent configures host-level iptables routing rules. When a container inside the task makes an HTTP GET request to http://169.254.170.2/v2/credentials/[credential_id], the packet is redirected to a local Unix domain socket or loopback port monitored by the ECS Agent: 

# Standard ECS task credential redirection rule on EC2 host
iptables -t nat -A PREROUTING -p tcp -d 169.254.170.2 --dport 80     -j DNAT --to-destination 127.0.0.1:51679

The security boundary collapsed because during rapid task scaling, container initialization, or spot instance rebalances, the agent briefly exposed an unverified socket binding window:

  • Credential ID Enumeration: The unique credential authorization token appended to the task request path (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) was generated using a predictable timestamp seed.
  • IPTables Redirection Race: A container utilizing raw socket manipulation or ARP spoofing within a shared Docker bridge network could race the agent's iptables synchronization, hijacking outgoing HTTP requests from adjacent tasks.
  • Host Instance Role Theft: If an attacker triggered a failure in the task metadata handler, the fallback mechanism defaulted to forwarding requests to the underlying EC2 instance profile, exposing host-level permissions (such as full ECR pull/push, CloudWatch administrative writes, or VPC attachment controls).

Attack Mechanics: Extracting AWS Temporary Session Tokens

An attacker operating within a low-privilege customer-facing microservice could exploit this flaw to assume the identity of a high-privilege backend microservice co-located on the same physical EC2 instance: 

# Attacker shell inside compromised container
$ curl -s http://169.254.170.2/v2/credentials/task-payment-service-auth-id
{
  "AccessKeyId": "ASIAEXAMPLEKEYID123",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "Token": "IQoJb3JpZ2luX2VjEEYaCXVzLWVhc3QtMSJHMEUCIQ...",
  "Expiration": "2026-09-25T10:30:00Z",
  "RoleArn": "arn:aws:iam::123456789012:role/ProductionPaymentProcessingRole"
}

With these credentials, the attacker bypasses all container isolation barriers, executing API commands against production Amazon DynamoDB databases, S3 financial ledgers, or AWS Secrets Manager vaults directly from outside the cluster.

Remediation Playbook: Securing Amazon ECS Workloads

  1. Upgrade ECS Container Agent to v1.84.0+: Ensure that all ECS container instances run the patched agent version: 
    # Check active ECS agent version
curl -s http://localhost:51678/v1/metadata | jq .Version

# Update agent via yum on Amazon Linux 2 / 2023
sudo yum update -y ecs-init
sudo systemctl restart ecs
  2. Migrate to AWS Fargate for Multi-Tenant Workloads: AWS Fargate eliminates shared EC2 hosts entirely. Each Fargate task executes inside its own dedicated microVM with an isolated kernel, eliminating cross-task metadata snooping risks by design.
  3. Enforce IMDSv2 and Disable IMDS from Containers: Block container access to the host instance metadata endpoint by setting the hop limit to 1: 
    # Set EC2 IMDS hop limit to 1 to block container traversal
aws ec2 modify-instance-metadata-options     --instance-id [INSTANCE_ID]     --http-tokens required     --http-put-response-hop-limit 1