CVE-2025-9039: Amazon ECS Agent Info Disclosure Flaw

CVE-2025-9039 Overview

CVE-2025-9039 is a medium-severity vulnerability in the Amazon Elastic Container Service (ECS) agent. The flaw allows the introspection server to be accessed off-host by another Amazon EC2 instance when the instances share a security group or when security group rules permit inbound traffic on the introspection server port (51678). This exposure enables an adjacent instance to query container and task metadata that should remain local to the host. The issue is tracked under [CWE-277: Insecure Inherited Permissions] and has been resolved in ECS agent version 1.97.1.

Critical Impact
An attacker-controlled or compromised EC2 instance in a permissive security group can read ECS task and container introspection data from neighboring hosts, exposing sensitive orchestration details.

Affected Products

Amazon ECS agent versions prior to 1.97.1
Amazon ECS-optimized Amazon Machine Images (AMIs) shipping older agent builds
Forked or derivative ECS agent codebases that have not merged the upstream fix

Discovery Timeline

2025-08-14 - CVE-2025-9039 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9039

Vulnerability Analysis

The Amazon ECS agent exposes an introspection HTTP endpoint that returns metadata about the agent, tasks, and containers running on the host. This endpoint is intended for on-host consumption only. Under certain configurations, the agent binds the introspection server in a way that allows off-host requests to reach port 51678. When two EC2 instances share a security group, or when a security group allows inbound TCP on 51678, an adjacent instance can query the introspection API of a neighboring host. Instances configured with the option to allow off-host access to the introspection server set to false are not affected.

Root Cause

The root cause is insecure inherited network permissions on the introspection listener [CWE-277]. The agent relied on default security group posture rather than binding the introspection server strictly to a loopback interface, allowing security group rules to determine reachability of a service that should be host-local.

Attack Vector

Exploitation requires network access to the vulnerable ECS host on port 51678 from another EC2 instance in the same VPC. An attacker with low privileges on a neighboring instance can issue HTTP GET requests to introspection paths such as the agent metadata and task list endpoints. Returned data can include container identifiers, task ARNs, image references, and runtime configuration useful for further lateral movement and reconnaissance within the ECS environment.

No verified proof-of-concept code has been published. See the AWS Security Bulletin AWS-2025-018 and the GitHub Security Advisory GHSA-wm7x-ww72-r77q for authoritative technical details.

Detection Methods for CVE-2025-9039

Indicators of Compromise

Inbound TCP connections to port 51678 on ECS container instances originating from other EC2 instance private IPs
HTTP GET requests to introspection paths such as /v1/metadata and /v1/tasks recorded in host or VPC flow logs
Security groups attached to ECS instances that permit intra-group traffic on port 51678

Detection Strategies

Enable VPC Flow Logs and alert on any traffic to destination port 51678 between EC2 instances
Audit running ECS agent versions across the fleet and flag any host running a version earlier than 1.97.1
Review AWS Config or infrastructure-as-code repositories for security group rules that inadvertently expose port 51678

Monitoring Recommendations

Ingest VPC Flow Logs, CloudTrail, and ECS container instance telemetry into a centralized analytics platform for correlation
Baseline expected callers of the introspection endpoint and alert on any off-host source
Monitor for outbound scanning behavior from workloads that could enumerate neighboring ECS hosts on port 51678

How to Mitigate CVE-2025-9039

Immediate Actions Required

Upgrade the Amazon ECS agent to version 1.97.1 or later on all container instances
Refresh ECS-optimized AMIs and rotate instances to pick up the patched agent
Restrict security group rules so port 51678 is not reachable from other EC2 instances

Patch Information

Amazon published the fix in Amazon ECS agent release 1.97.1. Details are available in the GitHub ECS Agent Release notes and the GitHub Security Advisory. Any forked or derivative ECS agent code must be rebased or patched to incorporate the upstream fix.

Workarounds

Modify EC2 security groups to deny inbound traffic to TCP port 51678 from all sources other than the local host
Set the ECS agent configuration to disallow off-host access to the introspection server where the option is available
Segment ECS container instances into dedicated security groups that do not permit intra-group traffic on the introspection port

bash

# Example: revoke intra-security-group access to the ECS introspection port
aws ec2 revoke-security-group-ingress \
  --group-id sg-EXAMPLE1234567890 \
  --protocol tcp \
  --port 51678 \
  --source-group sg-EXAMPLE1234567890

# Verify no rule permits inbound 51678
aws ec2 describe-security-groups \
  --group-ids sg-EXAMPLE1234567890 \
  --query "SecurityGroups[].IpPermissions[?FromPort==\`51678\`]"