CVE-2021-38112: Amazon AWS WorkSpaces RCE Vulnerability

CVE-2021-38112 Overview

CVE-2021-38112 is an argument injection vulnerability in the Amazon AWS WorkSpaces client for Windows, affecting versions 3.0.10 through 3.1.8. The vulnerability exists in the workspaces:// URI handler and can be exploited to achieve remote code execution through the Chromium Embedded Framework (CEF) --gpu-launcher argument. An attacker can craft a malicious link that, when clicked by a victim with the vulnerable client installed, executes arbitrary code on the target system.

Critical Impact

This vulnerability enables attackers to execute arbitrary code remotely by convincing users to click a malicious workspaces:// link, potentially leading to complete system compromise.

Affected Products

• Amazon AWS WorkSpaces Client for Windows versions 3.0.10 through 3.1.8

Discovery Timeline

• 2021-09-22 - CVE CVE-2021-38112 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-38112

Vulnerability Analysis

This vulnerability represents an argument injection flaw (CWE-88) in the way the AWS WorkSpaces Windows client handles the custom workspaces:// URI scheme. The application registers this protocol handler during installation, allowing web browsers and other applications to launch the WorkSpaces client with specific parameters.

The underlying issue stems from the client's use of the Chromium Embedded Framework (CEF) for rendering its user interface. CEF supports numerous command-line arguments, including the --gpu-launcher parameter, which specifies an executable to run as the GPU process. By injecting this argument through a specially crafted URI, an attacker can force the client to execute arbitrary commands.

When a user clicks a malicious workspaces:// link containing the injected --gpu-launcher argument, the WorkSpaces client processes the URI without proper sanitization, passing the attacker-controlled argument directly to CEF. This results in the execution of the attacker-specified command with the privileges of the current user.

Root Cause

The root cause of this vulnerability is improper neutralization of argument delimiters in the workspaces:// URI handler. The application fails to adequately validate and sanitize URI parameters before passing them to the underlying CEF framework. Specifically, the client does not filter or escape dangerous CEF command-line arguments like --gpu-launcher, allowing an attacker to inject arbitrary arguments through the URI scheme.

Attack Vector

The attack requires user interaction—specifically, the victim must click a malicious link. An attacker could distribute the malicious URI through various channels:

1. Phishing emails - Embedding the malicious workspaces:// link in email content
2. Malicious websites - Hosting a page that redirects to the crafted URI
3. Social engineering - Convincing users to click the link through messaging platforms

When the victim clicks the link with a vulnerable AWS WorkSpaces client installed, the operating system invokes the registered protocol handler. The crafted URI containing the --gpu-launcher argument causes CEF to spawn a new process executing the attacker's specified command.

The attack is particularly dangerous because workspaces:// links appear legitimate to users familiar with AWS WorkSpaces, and the execution occurs without any additional user prompts beyond the initial click.

Detection Methods for CVE-2021-38112

Indicators of Compromise

• Unexpected process spawns originating from the AWS WorkSpaces client (workspaces.exe)
• Processes with parent process being workspaces.exe that are unusual system utilities or scripts
• Network connections from WorkSpaces client to unexpected destinations
• Log entries showing abnormal workspaces:// URI invocations with suspicious parameters

Detection Strategies

• Monitor for process creation events where workspaces.exe spawns unexpected child processes
• Create detection rules for command-line arguments containing --gpu-launcher in processes related to WorkSpaces
• Implement email gateway filtering to detect and block workspaces:// URIs with suspicious parameters
• Deploy endpoint detection rules to identify URI handler abuse patterns

Monitoring Recommendations

• Enable detailed process auditing on endpoints running AWS WorkSpaces client
• Configure SIEM alerts for anomalous process chains involving the WorkSpaces application
• Monitor Windows event logs for protocol handler invocations with unusual parameters
• Review web proxy logs for redirects to workspaces:// URIs from external sources

How to Mitigate CVE-2021-38112

Immediate Actions Required

• Update Amazon AWS WorkSpaces client to version 3.1.9 or later immediately
• Audit all endpoints for vulnerable versions of the WorkSpaces client (3.0.10 through 3.1.8)
• Educate users about the risks of clicking unverified workspaces:// links
• Consider temporarily uninstalling vulnerable clients until updates can be deployed

Patch Information

Amazon has addressed this vulnerability in AWS WorkSpaces client version 3.1.9. The fix implements proper sanitization of URI parameters to prevent argument injection through the workspaces:// protocol handler. Organizations should download the updated client from the official AWS WorkSpaces download page and deploy it to all affected systems.

For detailed release information, refer to the AWS WorkSpaces Windows Client Release Notes.

Additional technical analysis of this vulnerability is available from Rhino Security Labs.

Workarounds

• Unregister the workspaces:// protocol handler from the Windows registry if immediate patching is not possible
• Implement network-level filtering to block suspicious workspaces:// URIs at the email gateway and web proxy
• Use application control solutions to restrict processes that can be spawned by the WorkSpaces client
• Deploy browser extensions or policies that warn users before following custom protocol handlers

# Remove WorkSpaces URI handler registration (temporary workaround)
# Run in elevated Command Prompt - restore handler after patching
reg delete "HKEY_CLASSES_ROOT\workspaces" /f