Wednesday, May 22, 2024

Reverse RDP – Microsoft Patch for RDP client Opens Room for Other Attacks

Researchers discovered several critical vulnerabilities that let attackers reverse the usual direction of communication and infect the user’s computer.

The vulnerability was found with Microsoft’s RDP client and it also applicable for guest-to-host VM escape in Hyper-V Manager.

Microsoft released a patch for the Path-Traversal vulnerability (CVE-2019-0887) as part of its July 2019 Patch. The vulnerability is due to a lack of sanitation checks, Microsoft added validation checks to PathCchCanonicalize.

Further analyzing Checkpoint researchers observed that Microsoft added a workaround to fix the vulnerability and leaving the root cause of the issue “PathCchCanonicalize,” API function unchanged.

By reverse engineering, it was observed that “Microsoft’s implementation of the function, and saw that it splits the path to parts by searching only for \ and ignoring /.”

This lets researchers bypass the issued patch by just replacing the backward slashes in the places of the forward slashes.

“The vulnerability that we just found is a classic case of implementing a sanity check using a different logic than the one that is used for the action we wish to protect.”

So the Checkpoint researchers again contacted Microsoft and disclosed the improperly fixed CVE-2019-0887, which opens a door for a new attack.

Microsoft acknowledged the report and patched again as a part of February’s Patch Tuesday. According to Microsoft to exploit the vulnerability “an attacker must already have compromised a system running Remote Desktop Services, and then wait for a victim system to connect to Remote Desktop Services.”

Now Microsoft fixed the vulnerability by correcting how Remote Desktop Services handles clipboard redirection.

Researchers stated that “Microsoft’s patch for CVE-2020-0655, this fix does not address the core vulnerability in the PathCchCanonicalize function.”

Check Point’s Omri Herscovici said. “We want developers to be aware of this threat so that they could go over their programs and manually apply a patch against it.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...

Critical Memory Corruption In Cloud Logging Infrastructure Enables Code Execution Attack

A new critical vulnerability has been discovered in Fluent Bit's built-in HTTP server, which...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles