Amazon SageMaker SDK Default Bucket Validation Bypass Leads to Data Exfiltration

Vulnerability Summary: Missing Default Bucket Validation in Amazon SageMaker Python SDK Vulnerability Overview When creating training and inference jobs, the Amazon SageMaker Python SDK defaults to using the parameter of . If not explicitly specified, this parameter automatically generates a bucket name based on the AWS account ID. Since the SDK does not verify whether this bucket already exists, an attacker who has pre-created a bucket with the same name can cause the SDK to erroneously use that bucket. This results in sensitive data, such as training scripts, source code, and models, being leaked to a bucket controlled by the attacker. Impact Scope Affected Versions: - - Fixed Versions: - - CVSS Score: 7.1 (High) Affected Components: - Training jobs, source code, and model data - Triggered only when the target bucket does not pre-exist Remediation 1. Upgrade SDK Version: - Recommended to upgrade to the latest stable version or a fixed version (e.g., or ). - Installation commands: 2. Manually Specify Default Bucket: - Explicitly set the parameter in the code to avoid reliance on automatically generated bucket names. - Example: 3. Enable Security Configurations in the AWS Shared Responsibility Model: - Ensure S3 bucket policies strictly restrict access to prevent unauthorized writes. POC / Exploitation Code No complete POC or exploitation code is provided in the source material, but the attack scenario is described as follows: The attacker pre-creates an S3 bucket with the same name as the one automatically generated by the SDK. When the victim runs a SageMaker training job, the SDK writes data to the bucket controlled by the attacker. The attacker can then read sensitive data such as training scripts, source code, and models. > Note: Actual exploitation requires specific AWS environment configurations and permission policies; no directly executable code snippets are available.

Goal Reached Thanks to every supporter — we hit 100%!

Amazon SageMaker SDK Default Bucket Validation Bypass Leads to Data Exfiltration

More from this source