GHSA-qjx4-hg6g-2f34: Secret masking bypass in the environment tool in Strands Agents Tools
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking.
To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.8.6 - Operational
Rotate any credentials that were present in the environment of agents that loaded the environment tool.
Event History
Frequently Asked Questions
Which deployments are exposed?
Agents using Strands Agents Tools versions before 0.8.6 are exposed if they loaded the environment tool. The risk includes any secrets available in the agent host environment, such as cloud credentials and API keys.
What does an attacker need to exploit this issue?
A remote attacker needs to supply a crafted prompt that disables the environment tool's secret masking. The supplied vector indicates no privileges are required, but user interaction is required.
What should be done if an affected agent may have processed malicious prompts?
Upgrade to version 0.8.6 or later, then rotate credentials that were present in the environment of agents that loaded the environment tool. Treat exposed environment variables as potentially disclosed in cleartext.