CVE-2025-3047: AWS SAM CLI Privilege Escalation Flaw

CVE-2025-3047 Overview

CVE-2025-3047 is a symlink attack vulnerability affecting the AWS Serverless Application Model Command Line Interface (SAM CLI). When running the SAM CLI build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. An attacker could exploit the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container.

Critical Impact

Attackers can leverage symlinks during the Docker-based build process to read privileged host files, potentially exposing sensitive credentials, configuration data, or other protected information from the development or build environment.

Affected Products

• AWS SAM CLI versions prior to v1.133.0
• Docker-based SAM CLI build environments with symlinks in build files
• Forked or derivative SAM CLI implementations lacking the security patch

Discovery Timeline

• March 31, 2025 - CVE-2025-3047 published to NVD
• October 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-3047

Vulnerability Analysis

This vulnerability falls under CWE-61 (UNIX Symbolic Link Following), a class of file system vulnerabilities where applications follow symbolic links without proper validation. In the context of AWS SAM CLI, the build process running within Docker containers does not adequately restrict symlink resolution, allowing symbolic links within build artifacts to point to and access files outside the intended build context on the host system.

The elevated permissions granted to the SAM CLI tool during Docker-based builds create an environment where symlinks can be exploited to traverse the file system boundary between the container and host. This allows unauthorized access to privileged files that should remain protected from container workloads.

Root Cause

The root cause of this vulnerability lies in insufficient symlink validation during the SAM CLI build process when operating with Docker. The tool fails to properly sanitize or restrict symlink targets within build files, allowing symbolic links to reference arbitrary host paths. Combined with the elevated permissions required for Docker operations, this creates a path traversal condition where container processes can read files outside their intended scope.

Attack Vector

The attack requires network access and user interaction (specifically, a user must run the vulnerable SAM CLI build command). An attacker could craft malicious build files containing symbolic links that point to sensitive host files such as /etc/passwd, SSH keys, AWS credentials, or other privileged configuration files. When the SAM CLI build process executes within Docker, these symlinks are followed with elevated permissions, allowing the attacker to read the targeted files and copy them to an accessible location within the container's file system.

The exploitation scenario typically involves:

1. Creating a serverless application project with malicious symlinks embedded in the build artifacts
2. The symlinks target sensitive host files outside the build context
3. During sam build execution with Docker, the container follows these symlinks
4. The elevated permissions allow reading privileged host files
5. The attacker copies the exposed content to a permissive container location for exfiltration

Detection Methods for CVE-2025-3047

Indicators of Compromise

• Unexpected symlinks in SAM CLI project directories or build artifacts pointing outside the project root
• Build processes accessing files in /etc/, /root/, or other sensitive host directories
• Unusual file copy operations from privileged locations to container-accessible paths
• SAM CLI build logs showing resolution of unexpected file paths

Detection Strategies

• Monitor SAM CLI build processes for symlink creation or resolution to paths outside the project directory
• Implement file integrity monitoring on sensitive host files accessed during container operations
• Review SAM CLI project files for suspicious symbolic links before executing builds
• Enable Docker audit logging to track container-to-host file access patterns

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions to monitor file system operations during SAM CLI builds
• Configure alerting for Docker container processes that access sensitive host paths such as credentials or configuration files
• Implement SentinelOne Singularity to detect anomalous file access patterns indicative of symlink exploitation
• Review AWS CloudTrail logs for unusual SAM deployment activities that may follow exploitation attempts

How to Mitigate CVE-2025-3047

Immediate Actions Required

• Upgrade AWS SAM CLI to version v1.133.0 or newer immediately
• Review existing SAM CLI projects for suspicious symlinks in build directories
• Audit any forked or derivative SAM CLI implementations and apply equivalent patches
• Temporarily avoid using Docker-based SAM CLI builds if immediate patching is not possible

Patch Information

AWS has released security patches addressing this vulnerability. Users should upgrade to SAM CLI version v1.133.0 or newer. The security advisory and release information can be found through the following resources:

• AWS Security Bulletin AWS-2025-008
• GitHub AWS SAM CLI Release v1.134.0
• GitHub Security Advisory GHSA-px37-jpqx-97q9

Workarounds

• Avoid using Docker-based builds with untrusted or externally-sourced SAM CLI projects until patched
• Manually inspect build directories for symlinks before executing sam build commands
• Use non-Docker build modes where possible as a temporary mitigation
• Implement strict file system permissions to limit the impact of potential symlink traversal

# Check SAM CLI version and upgrade if needed
sam --version
pip install --upgrade aws-sam-cli

# Verify installation meets minimum patched version
sam --version | grep -E "SAM CLI, version 1\.(1[3-9][3-9]|[2-9][0-9]{2})\."