CyberRota Analysis
AI-GeneratedThe http_request tool in Strands Agents Tools prior to version 0.8.2 is vulnerable due to incorrect authorization, potentially allowing remote attackers to access sensitive credentials configured via HTTP_REQUEST_TOKEN_CONFIG. This vulnerability can be exploited by manipulating the LLM to route requests through a proxy controlled by the attacker, posing a significant risk to user data and system integrity. Organizations using affected versions should prioritize upgrading to version 0.8.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to version 0.8.2.