Black Hat USA 2025 | ECS-Cape – Hijacking IAM Privileges in Amazon ECS

Why It Matters

If exploited, a single compromised container can seize IAM privileges across an entire ECS cluster, giving attackers unfettered access to all workloads and data.

Key Takeaways

• ECS tasks can impersonate the ECS agent via internal ACS protocol.
• Instance role credentials allow tasks to discover poll endpoint and metadata.
• Container introspection API reveals container instance ARN for full impersonation.
• Exploited vulnerability grants access to all task and execution roles on host.
• Mitigations include restricting IMDS, removing host mounts, and tightening permissions.

Summary

The Black Hat talk unveiled a critical flaw dubbed “EC escape” that lets a single container running on an Amazon ECS‑EC2 instance hijack IAM credentials of every other container on the same host. By abusing the internal Agent Communication Service (ACS) protocol, an attacker can masquerade as the ECS agent and retrieve temporary credentials for both task and task‑execution roles, effectively compromising the entire workload. The researcher demonstrated how the ECS agent registers the container instance, discovers a poll endpoint, and opens a websocket with a “sendCredentials=true” flag. Because the EC2 instance’s IAM role is exposed via the Instance Metadata Service (IMDS), a malicious task can obtain the same role, call the discover‑poll API, and, using the container introspection endpoint, harvest the container‑instance ARN needed to forge a valid ACS request. The resulting websocket streams assumed credentials for every task on the node, bypassing the need to invoke AssumeRole. Key evidence included captured websocket messages showing raw task credentials and the realization that the “sendCredentials” query parameter is the linchpin. The attacker leveraged predictable poll‑endpoint URLs, IMDS‑derived region and instance data, and the introspection API to reconstruct the full request without special host‑mount configurations, proving the exploit works in typical ECS‑EC2 deployments. The vulnerability threatens a large segment of cloud workloads—roughly one‑third of developers using container orchestration rely on ECS. Organizations must tighten instance‑role policies, disable or restrict IMDS access, avoid exposing host file systems, and consider revoking the discover‑poll and register‑container‑instance permissions from tasks. Monitoring for unauthorized ACS websocket connections and auditing ECS agent activity become essential controls.

Original Description

Amazon Elastic Container Service (ECS) is a popular container orchestration service that relies on IAM roles for fine-grained access control. Our research uncovered a critical privilege escalation vulnerability that allows a low-privileged task running on an ECS instance to hijack the IAM privileges of higher-privileged containers on the same EC2 machine.

This talk will unveil the details of this previously undisclosed vulnerability, dubbed ECS-cape, which exploits an undocumented ECS protocol to escalate privileges. By taking advantage of shared infrastructure in containerized environments, attackers can use this technique to gain unauthorized access to cloud resources.

We will demonstrate ECS-cape live, showcasing how an attacker can leverage this flaw to escalate privileges. The session will also cover practical defense strategies, detailing why co-locating high-privilege and low-privilege workloads on the same ECS instance is risky and how organizations can architect their cloud environments to mitigate this attack vector.

Attendees will leave with a clear understanding of how to detect, mitigate, and prevent similar privilege escalation risks in their cloud infrastructure.

By:

Naor Haziz | Senior Software Developer, Sweet Security

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#ecs-cape--hijacking-iam-privileges-in-amazon-ecs-45686