GNOME desktop manager was equipped with a new feature which allowed remote users to create graphical sessions on the system by configuring the system daemon.
This daemon runs as a dedicated “gnome-remote-desktop” and also provides a D-bus interface on the D-bus system bus.
These features have been introduced in GNOME remote desktop version 46 along with several other system services.
However, some of the new system services were discovered with some critical security issues in which one of them was associated with System credentials leak and Local Private Key Leak.
According to the reports shared with Cyber Security News, the Local private key leak exists due to the fact that the system daemon keeps public SSL certificates and respective private keys in /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates location.
The access to this directory is also restricted to and can only be accessed by the service user “gnome-remote-desktop”, mode 0700. However, any local user can intercept the private SSL key via “org.gnome.RemoteDesktop.Rdp.Handover” D-Bus interface.
Additionally, the private key is also returned from the StartHandover D-Bus function that can also be intercepted.
If a remote desktop client connects to the system daemon, the time window is too long which can be utilized by an attacker to call this method on the created session object.
This leads to an unauthenticated access to the D-bus interface which allows a threat actor to connect to the system daemon without any authentication or required.
Nevertheless, for escalating this vulnerability into a denial of service condition which requires valid RDP credentials.
If any RDP connection uses shared system credentials, a threat actor with low privileges can gain these credentials in cleartext similar to the previous interception method and call an unauthenticated D-Bus method “GetSystemCredentials()” of the handover interface.
Further, these system credentials can also be used by a threat actor to connect to the GDM via RDP.
However, it does not directly grant a session for a threat actor as there is an authentication present in the display manager that must be performed.
In case if there is an automatic login configured, then the authentication is a piece of cake for the threat actor.
These vulnerabilities have been fixed in the latest release of GNOME remote desktop.
A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver Fox,…
A new wave of cyberattacks attributed to the Ghostwriter Advanced Persistent Threat (APT) group has…
The LCRYX ransomware, a malicious VBScript-based threat, has re-emerged in February 2025 after its initial…
Recent cybersecurity investigations have uncovered a sophisticated technique employed by threat actors to evade detection…
A financial management app named Finance Simplified has been revealed as a malicious tool for…
A recent discovery by cybersecurity researchers has revealed that the Poseidon malware, a macOS-targeting trojan,…