A recent security flaw in AWS’s Kiro coding IDE allowed malicious actors to execute code on developers’ machines without their consent. This vulnerability, identified by Intezer and Kodem Security, involved Kiro rewriting its configuration file and executing external code based on hidden text embedded in a web page. Although AWS has addressed the issue, it highlights significant security concerns in software development environments.
Remote Code Execution via Hidden Text
The flaw was related to Kiro’s handling of external content. Researchers found that when Kiro was asked to summarize a webpage, it could inadvertently run remote code. This happened because the agent’s safety model relied on user approval, which the exploit managed to bypass. By embedding instructions in barely visible text within a webpage, attackers could manipulate Kiro’s settings and execute arbitrary code.
The vulnerability stemmed from Kiro’s configuration file at ~/.kiro/settings/mcp.json, which dictates the external tools the IDE can load. If an attacker altered this file, Kiro would automatically reload it, launching potentially harmful code with the developer’s privileges. This issue was compounded by Kiro’s ability to modify this file autonomously without seeking user approval.
Implications and Past Vulnerabilities
The implications of this vulnerability are severe, as it allows attackers to gain unauthorized access to sensitive information and execute harmful commands. Intezer’s demonstration showed how the exploit could be used to extract system details, but it could also be extended to steal credentials or access internal systems. Although AWS has released patches, the flaw was live in specific versions of Kiro at the time of discovery.
This is not the first time Kiro has faced such vulnerabilities. Previous iterations allowed similar exploits, where the IDE would execute code from altered configuration files without proper user consent. AWS attempted to mitigate these issues by introducing approval prompts, but gaps remained, particularly in the Autopilot mode.
Resolution and Future Outlook
AWS has responded by updating Kiro to prevent unauthorized changes to its configuration files, now requiring explicit user approval for any modifications. The update also introduces a protected-paths system to safeguard critical files, marking a shift towards a more secure development environment. This approach ensures that even if the model is compromised, the platform enforces necessary security checks.
Despite the absence of a CVE assignment for this vulnerability, AWS has urged users to update to the latest Kiro version. The ongoing discovery of vulnerabilities in AI-driven coding tools underscores the need for robust platform-level security measures. As development workflows increasingly rely on automated systems, ensuring these systems are secure remains a top priority.
The Hacker News continues to seek clarification from AWS regarding the affected versions and the decision not to assign a CVE. Meanwhile, developers are encouraged to update their IDEs to avoid potential security risks.
