Executive Summary

This vulnerability exists in xrdp, an open source RDP server, in versions through 0.10.5. It allows an authenticated remote user to execute arbitrary commands on the server because of unsafe handling of the AlternateShell parameter in xrdp-sesman.

When the AllowAlternateShell setting is enabled (which is the default if not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This means that unsanitized, user-controlled input is executed as a shell command.

This behavior provides a scriptable remote command execution capability over RDP within the security context of the authenticated user, occurring before the normal window manager starts. It can bypass expected session initialization flows and assumptions that restrict execution to interactive desktop environments.

The issue was fixed in version 0.10.6.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated remote user to execute arbitrary commands on the affected server with the privileges of the authenticated user.

Because the commands are executed before the normal desktop environment starts, it can bypass security controls or operational assumptions that expect execution only within an interactive desktop session.

This could lead to unauthorized actions such as data manipulation, privilege escalation (depending on user privileges), or disruption of normal server operations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade xrdp to version 0.10.6 or later where the issue has been fixed.

Alternatively, disable the AllowAlternateShell setting in the xrdp configuration to prevent execution of client-supplied AlternateShell commands.

Useful 0 Not Useful 0