Executive brief
Amazon ECS is a service used to run and manage containerized applications in the cloud. A vulnerability in the ECS agent's monitoring tool could allow unauthorized users on the same network to view sensitive information about the state of the system and its containers. This could lead to the exposure of internal configuration details or operational data to other systems within the same environment.
Technical details
The Amazon ECS agent introspection server, which provides an API for monitoring the state of the agent and container instances, contains a flaw that allows off-host access under certain configurations. If the introspection server is not explicitly configured to disallow off-host access (set to 'false'), an attacker on a different instance can reach the API if network security groups permit inbound traffic on port 51678. This could result in the disclosure of sensitive metadata regarding the ECS agent and managed containers. The issue is resolved in ECS Agent version 1.97.1. As a workaround, users can restrict access to port 51678 via EC2 security groups.
Affected products
- Amazon Web Services (AWS) ECS Agent 0.0.3 through 1.97.0
Timeline
- 2025-08-14: disclosed
- 2025-08-14: advisory
- 2025-08-14: patched: Fixed in ECS Agent version 1.97.1