{"vulnerability": "cve-2021-38112", "sightings": [{"uuid": "c0ca5b70-9931-46b8-84a7-651ce76b8b67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "published-proof-of-concept", "source": "https://t.me/cloud_sec/203", "content": "\ud83d\udd36 CVE-2021-38112: AWS WorkSpaces Remote Code Execution\n\nA vulnerability in the AWS WorkSpaces desktop client (CVE-2021-38112), which allows commands to be executed if a victim opens a malicious WorkSpaces URI from their browser.\n\nhttps://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/\n\n#aws", "creation_timestamp": "2021-09-27T06:31:36.000000Z"}, {"uuid": "bcbce104-1650-4afd-a717-4954c978701a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "seen", "source": "https://t.me/cibsecurity/29211", "content": "\u203c CVE-2021-38112 \u203c\n\nIn the Amazon AWS WorkSpaces client before 3.1.9 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-22T07:28:28.000000Z"}, {"uuid": "cd2f4ecc-5b9a-4852-80b5-f4c4d2708823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "seen", "source": "https://t.me/information_security_channel/45320", "content": "Remote Code Execution Vulnerability Found in AWS WorkSpaces\nhttp://feedproxy.google.com/~r/securityweek/~3/yPzIUfA2pFw/remote-code-execution-vulnerability-found-aws-workspaces\n\nRhino Security Labs researchers have identified a vulnerability in the AWS WorkSpaces desktop client that could allow an attacker to execute arbitrary code remotely.\nTracked as CVE-2021-38112, the security bug could be triggered when the user opens a malicious WorkSpaces URI from the browser, allowing a remote attacker to execute arbitrary code on the vulnerable system.\nread more (https://www.securityweek.com/remote-code-execution-vulnerability-found-aws-workspaces)", "creation_timestamp": "2021-09-22T18:22:12.000000Z"}, {"uuid": "ee74fd48-b8ff-4537-9cc5-e5f7fb1ca34f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4358", "content": "#Cloud_Security\nCVE-2021-38112:\nAWS WorkSpaces Desktop Client RCE\nhttps://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce", "creation_timestamp": "2021-09-23T11:07:01.000000Z"}, {"uuid": "e10186b3-6523-4d90-8e3b-c7b733e1b8c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4416", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Sep 1-30)\nCVE-2021-40444 - Microsoft MSHTML RCE\nhttps://t.me/cybersecuritytechnologies/4276\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-22005 - vCenter Server contains - arbitrary file upload\nhttps://t.me/cybersecuritytechnologies/4401\nCVE-2021-30860 - Zero-Click iPhone Exploit\nhttps://t.me/cybersecuritytechnologies/4318\nCVE-2021-38647 - OMIGOD RCE Vuln in Multiple Azure Linux Deployments\nhttps://t.me/cybersecuritytechnologies/4315\nCVE-2021-30632 - Out of bounds write in V8\nhttps://t.me/cybersecuritytechnologies/4342\nCVE-2021-33035 - Code Execution in Apache OpenOffice\nhttps://t.me/cybersecuritytechnologies/4329\nCVE-2021-38112 - AWS WorkSpaces Desktop Client RCE\nhttps://t.me/cybersecuritytechnologies/4358\nCVE-2021-30740 / CVE-2021-30768 - A malicious application may be able to execute arbitrary code with kernel privileges\nhttps://mobile.twitter.com/infinityABCDE/status/1437596340222038017", "creation_timestamp": "2021-10-01T11:01:01.000000Z"}, {"uuid": "fdb2e170-1687-4ed1-b3fc-753766820900", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "seen", "source": "https://t.me/cissp/4457", "content": "Offensive security\n1. From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure\nhttps://gist.github.com/gladiatx0r/1ffe59031d42c08603a3bde0ff678feb\n]-> Python tool to Check running WebClient services on multiple targets:\nhttps://github.com/Hackndo/WebclientServiceScanner\n2. How To Test Custom Shellcode Using a C Payload Tester\nhttps://secureideas.com/blog/2021/09/linux-x86-assembly-how-to-test-custom-shellcode-using-a-c-payload-tester.html\n\nCloud Security\nCVE-2021-38112:\nAWS WorkSpaces Desktop Client RCE\nhttps://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce\n\nThreat Research\n1. Netgear SOHO Security Bug Allows RCE, Corporate Attacks (CVE-2021-40847)\nhttps://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html?m=1\n2. A vmap/vmalloc use-after-free vulnerability within the Android ION allocator\nhttps://labs.taszk.io/blog/post/61_android_ion_uaf\n\nRed Team Tactics\n1. XSS payloads for bypassing WAF\ud83d\ude0a\nhttps://github.com/Walidhossain010/WAF-bypass-xss-payloads\n2. Resetting Expired Passwords Remotely\ud83e\udd13\nhttps://www.n00py.io/2021/09/resetting-expired-passwords-remotely", "creation_timestamp": "2026-09-01T17:00:39.670143Z"}, {"uuid": "b07abfae-31e7-4f12-b62a-7fdf53e852fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38112", "type": "seen", "source": "https://t.me/cissp/4457", "content": "Offensive security\n1. From RPC to RCE - Workstation Takeover via RBCD and MS-RPChoose-Your-Own-Adventure\nhttps://gist.github.com/gladiatx0r/1ffe59031d42c08603a3bde0ff678feb\n]-> Python tool to Check running WebClient services on multiple targets:\nhttps://github.com/Hackndo/WebclientServiceScanner\n2. How To Test Custom Shellcode Using a C Payload Tester\nhttps://secureideas.com/blog/2021/09/linux-x86-assembly-how-to-test-custom-shellcode-using-a-c-payload-tester.html\n\nCloud Security\nCVE-2021-38112:\nAWS WorkSpaces Desktop Client RCE\nhttps://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce\n\nThreat Research\n1. Netgear SOHO Security Bug Allows RCE, Corporate Attacks (CVE-2021-40847)\nhttps://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html?m=1\n2. A vmap/vmalloc use-after-free vulnerability within the Android ION allocator\nhttps://labs.taszk.io/blog/post/61_android_ion_uaf\n\nRed Team Tactics\n1. XSS payloads for bypassing WAF\ud83d\ude0a\nhttps://github.com/Walidhossain010/WAF-bypass-xss-payloads\n2. Resetting Expired Passwords Remotely\ud83e\udd13\nhttps://www.n00py.io/2021/09/resetting-expired-passwords-remotely", "creation_timestamp": "2026-09-02T01:04:25.020293Z"}]}