Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Open Job Description Sessions, a component used by the AWS Deadline Cloud worker agent, could allow an authenticated user to execute arbitrary code. This could potentially lead to the compromise of AWS credentials held by the worker agent.
- Issue: Code execution via a search path flaw.
- Why remember: Potential credential theft from workers.
- Takeaway: Verify relevance for cloud rendering operations.
Attack Path
How an attacker could exploit the issue
An authenticated remote user with job submission permissions could exploit a weakness in the Open Job Description Sessions for Python, as used by the AWS Deadline Cloud worker agent. By submitting a specially crafted job, an attacker could manipulate the system's PATH environment variable to trick the worker agent into executing arbitrary code. This could lead to the compromise of the worker agent's AWS credentials, allowing the attacker to potentially gain further access.
- Authenticated remote user with job submission rights.
- Crafted job modifies the PATH environment variable.
- Arbitrary code execution and credential theft.
Live Threat
Current exploitation, exposure, and threat context
An authenticated remote user with job submission permissions to a queue could leverage a search path vulnerability in the Open Job Description Sessions for Python to execute arbitrary code as the worker agent's operating system user. This could lead to the compromise of AWS credentials held by the worker agent when supported by the advisory's conditions.
- Worker agent OS user code execution.
- Crafted job modifies PATH environment variable.
- Compromise of AWS credentials.
Operational Fix
Recommended remediation, mitigation, and detection steps
System owners and application teams responsible for customer-managed fleets should prioritize identifying all instances of the AWS Deadline Cloud worker agent, confirming their network reachability and business criticality, and then planning remediation. Service-managed fleets have already been remediated by AWS.
- Own the issue and coordinate with AWS.
- Verify worker agent deployment and reachability.
- Plan upgrade based on fleet criticality.
