CVE-2025-12779: Amazon WorkSpaces Auth Bypass Flaw

CVE-2025-12779 Overview

CVE-2025-12779 affects the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8. The client improperly handles authentication tokens for DCV-based WorkSpaces, exposing them to other local users on the same client machine. A local user can extract another user's authentication token from the shared host and access that user's WorkSpace session.

The issue is tracked under [CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere]. Amazon addressed the flaw in Amazon WorkSpaces client for Linux version 2025.0.

Critical Impact
A local unprivileged user on a shared Linux workstation can steal a co-tenant's WorkSpaces authentication token and hijack their remote desktop session, gaining access to corporate data.

Affected Products

Amazon WorkSpaces client for Linux 2023.0 through 2024.8
DCV-based WorkSpaces accessed via the affected Linux client
Shared Linux workstations running the vulnerable client versions

Discovery Timeline

2025-11-05 - CVE-2025-12779 published to NVD
2025-11-05 - AWS publishes Security Bulletin AWS-2025-025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12779

Vulnerability Analysis

The Amazon WorkSpaces client for Linux stores or processes the DCV session authentication token in a manner that permits access by other local user accounts on the same machine. When multiple users share a Linux workstation, the token that authorizes a DCV WorkSpaces session becomes readable outside the owning user's control sphere.

The root weakness maps to CWE-497, where sensitive system information reaches an unauthorized recipient. In this case, the sensitive artifact is the bearer token used to establish and maintain the remote session with the WorkSpace.

Because DCV tokens authorize interactive access to the remote desktop, possession of the token equals possession of the session. An attacker who reads the token from disk or process memory can replay it to connect to the victim's WorkSpace without knowing the victim's credentials.

Root Cause

The client fails to restrict access to the authentication token to the owning user. Insufficient file permissions, world-readable state locations, or shared temporary storage allow any local user to enumerate and read tokens belonging to other users of the client on the same host.

Attack Vector

Exploitation requires local access with low privileges and no user interaction from the victim. The attacker executes standard file or process inspection utilities under their own account to locate and copy another user's WorkSpaces token. The attacker then supplies the stolen token to a DCV client to hijack the victim's WorkSpace session, achieving full confidentiality, integrity, and availability impact on the remote environment.

Refer to the AWS Security Bulletin AWS-2025-025 for vendor technical details.

Detection Methods for CVE-2025-12779

Indicators of Compromise

Unexpected read access to Amazon WorkSpaces client state files or cache directories under another user's home directory
DCV session connections originating from IP addresses or hostnames that do not match the assigned user's typical workstation
Concurrent active WorkSpaces sessions for a single user account from distinct source endpoints
Local processes owned by user A reading files or /proc entries belonging to user B's WorkSpaces client process

Detection Strategies

Audit filesystem access on shared Linux hosts using auditd rules targeting the WorkSpaces client configuration and cache paths
Monitor AWS CloudTrail and WorkSpaces access logs for session establishment events that do not correlate with the expected user's device fingerprint
Alert on multiple simultaneous DCV connections to a single WorkSpace from different source IPs within short time windows

Monitoring Recommendations

Enable process and file access telemetry on all multi-user Linux workstations that run the Amazon WorkSpaces client
Correlate endpoint telemetry with WorkSpaces authentication events to detect token reuse across hosts
Track version inventory of the Amazon WorkSpaces client for Linux and flag any endpoint running versions 2023.0 through 2024.8

How to Mitigate CVE-2025-12779

Immediate Actions Required

Upgrade the Amazon WorkSpaces client for Linux to version 2025.0 or later on every affected endpoint
Inventory shared Linux workstations and prioritize patching hosts with multiple interactive user accounts
Rotate or invalidate active WorkSpaces sessions after upgrading to invalidate any previously exposed tokens

Patch Information

Amazon released Amazon WorkSpaces client for Linux version 2025.0, which remediates the improper token handling. Installation instructions and release notes are available in the AWS WorkSpaces Linux Client Release Notes. Full advisory details are published in AWS Security Bulletin AWS-2025-025.

Workarounds

Restrict use of the Amazon WorkSpaces Linux client to single-user workstations until the upgrade is complete
Disable or remove local accounts belonging to users who do not require access on shared hosts running the client
Enforce strict home directory permissions (chmod 700) to reduce the exposure surface of client state files

bash

# Verify the installed client version and enforce restrictive home directory permissions
workspacesclient --version
chmod 700 /home/*/
chmod 700 /home/*/.local/share/Amazon\ Web\ Services/