Listen to this Post
How the CVE Works
CVE-2025-9039 exploits a misconfiguration in the Amazon ECS agent’s introspection API, which runs on port 51678. By default, the API is accessible to other instances within the same security group or those with permissive inbound rules. Attackers can query this API to gather sensitive container metadata, task details, and agent state information. The vulnerability stems from improper access controls, allowing unauthorized off-host interactions when security groups are overly permissive. Versions 0.0.3 to 1.97.0 are affected.
DailyCVE Form
Platform: Amazon ECS
Version: 0.0.3-1.97.0
Vulnerability: API Exposure
Severity: Critical
Date: 2025-03-15
Prediction: Patch by 2025-04-10
What Undercode Say
Analytics
nmap -p 51678 <target_IP> curl http://<target_IP>:51678/v1/metadata aws ec2 describe-security-groups --group-ids <sg-id>
Exploit
- Query exposed introspection API.
- Enumerate container tasks.
- Leverage misconfigured SGs.
Protection from this CVE
- Upgrade to v1.97.1.
- Restrict port 51678 ingress.
- Set off-host access to ‘false’.
Impact
- Data leakage.
- Unauthorized access.
- Cluster compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
