AWS - Bedrock Post Exploitation

Tip

Ucz się & ćwicz AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Ucz się & ćwicz GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Ucz się & ćwicz Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Wspieraj HackTricks

• Sprawdź subscription plans!
• Dołącz do 💬 Discord group lub telegram group lub śledź nas na Twitterze 🐦 @hacktricks_live.
• Podziel się hacking tricks, zgłaszając PRy do HackTricks i HackTricks Cloud github repos.

AWS - Bedrock Agents Memory Poisoning (Indirect Prompt Injection)

Overview

Amazon Bedrock Agents with Memory mogą przechowywać podsumowania poprzednich sesji i wstrzykiwać je do przyszłych orchestration prompts jako system instructions. Jeśli niezaufany output z narzędzia (na przykład treść pobrana z zewnętrznych stron WWW, plików lub third‑party APIs) zostanie włączony do wejścia kroku Memory Summarization bez sanitizacji, atakujący może zatruć long‑term memory przez indirect prompt injection. Zatruwana pamięć następnie wpływa na planning agenta w przyszłych sesjach i może powodować ukryte działania, takie jak cicha data exfiltration.

To nie jest luka w samej platformie Bedrock; to klasa ryzyka agenta, gdy niezaufane treści trafiają do promptów, które potem stają się wysokopriorytetowymi system instructions.

How Bedrock Agents Memory works

• When Memory is enabled, the agent summarizes each session at end‑of‑session using a Memory Summarization prompt template and stores that summary for a configurable retention (up to 365 days). In later sessions, that summary is injected into the orchestration prompt as system instructions, strongly influencing behavior.
• The default Memory Summarization template includes blocks like:
• <previous_summaries>$past_conversation_summary$</previous_summaries>
• <conversation>$conversation$</conversation>
• Guidelines require strict, well‑formed XML and topics like “user goals” and “assistant actions”.
• If a tool fetches untrusted external data and that raw content is inserted into $conversation$ (specifically the tool’s result field), the summarizer LLM may be influenced by attacker‑controlled markup and instructions.

Attack surface and preconditions

An agent is exposed if all are true:

• Memory is enabled and summaries are reinjected into orchestration prompts.
• The agent has a tool that ingests untrusted content (web browser/scraper, document loader, third‑party API, user‑generated content) and injects the raw result into the summarization prompt’s <conversation> block.
• Guardrails or sanitization of delimiter‑like tokens in tool outputs are not enforced.

Injection point and boundary‑escape technique

• Precise injection point: the tool’s result text that is placed inside the Memory Summarization prompt’s <conversation> ... $conversation$ ... </conversation> block.
• Boundary escape: a 3‑part payload uses forged XML delimiters to trick the summarizer into treating attacker content as if it were template‑level system instructions instead of conversation content.
• Part 1: Ends with a forged </conversation> to convince the LLM that the conversation block ended.
• Part 2: Placed “outside” any <conversation> block; formatted to resemble template/system‑level instructions and contains the malicious directives likely to be copied into the final summary under a topic.
• Part 3: Re‑opens with a forged <conversation>, optionally fabricating a small user/assistant exchange that reinforces the malicious directive to increase inclusion in the summary.