Published: 22/09/2021 Updated: 30/09/2021

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 829

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

In the Amazon AWS WorkSpaces client 3.0.10 up to and including 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.

Vulnerable Product	Search on Vulmon	Subscribe to Product
amazon aws workspaces

Cloud Security - Attacks AWS Privilege Escalation to SYSTEM in AWS VPN Client rhinosecuritylabscom/aws/cve-2022-25165-aws-vpn-client/ AWS WorkSpaces Remote Code Execution rhinosecuritylabscom/aws/cve-2021-38112-aws-workspaces-rce/ Resource Injection in CloudFormation Templates rhinosecuritylabscom/aws/cloud-malware-cloudformation-injection/ Down

Azure and AWS Attacks

Cloud Security - Attacks AWS Privilege Escalation to SYSTEM in AWS VPN Client rhinosecuritylabscom/aws/cve-2022-25165-aws-vpn-client/ AWS WorkSpaces Remote Code Execution rhinosecuritylabscom/aws/cve-2021-38112-aws-workspaces-rce/ Resource Injection in CloudFormation Templates rhinosecuritylabscom/aws/cloud-malware-cloudformation-injection/ Down

CWE-88 https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/https://nvd.nist.gov https://github.com/Jaikumar3/Cloud-Security-Attacks https://github.com/CyberSecurityUP/Cloud-Security-Attacks

CVE-2021-38112

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect