Attack Chain

1. An attacker with standard user privileges identifies the directory structure used by the Skylight Workspace Config Service under 'C:\ProgramData\Amazon'.
2. The attacker creates a directory junction (e.g., a 'ROTATE' junction) to intercept log rotation file operations.
3. The attacker deploys a malicious payload in a location accessible to the service.
4. The attacker waits for the scheduled log rotation process initiated by the service.
5. The attacker exploits the TOCTOU race condition during the 1-10 ms window between the service performing the file move and the enumeration of archived files.
6. The service, operating as SYSTEM, inadvertently writes the attacker-controlled content or moves a malicious file to a privileged location.
7. The attacker executes the payload to gain elevated privileges.

Impact

Successful exploitation allows a low-privileged user to gain SYSTEM-level execution on the affected host, facilitating full system compromise.

Recommendation

• Patch all Amazon WorkSpaces Skylight installations to version 2.6.2034.0 or later immediately.
• Audit existing directory junctions and file permissions within 'C:\ProgramData\Amazon' for unauthorized modifications.
• Review process-creation logs for execution of binaries originating from suspicious directories or unexpected command-line arguments involving 'cfn-bootstrap' or similar service-related paths.