RustDesk Session Scope Bypass via Control Message Injection

Impact Analysis

This vulnerability can allow an attacker with limited session permissions to escalate their control over the host system beyond what was intended. For example, a user granted only file transfer or camera viewing permissions could potentially gain full remote control capabilities.

Such unauthorized control could lead to unauthorized observation, manipulation, or control of the host system, potentially compromising sensitive data, disrupting operations, or enabling further attacks.

Useful 0 Not Useful 0

Executive Summary

This vulnerability in RustDesk versions before 1.4.9 occurs because the server does not enforce the authorized connection scope for a session. This means that a peer who is granted a limited session type, such as FileTransfer, PortForward, ViewCamera, or Terminal, can send control messages and login options that are meant only for a full Remote session.

As a result, an authenticated remote peer can exploit this missing scope check to act beyond its granted permissions, injecting out-of-scope control messages to observe and control the host in ways that should not be allowed.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for SessionScopeViolation alarms triggered by out-of-scope control messages sent by authenticated peers. The RustDesk server connection layer now includes detailed audit logging for such violations, which can be reviewed to identify unauthorized session activities.

Specifically, audit logs will record attempts to send control messages or login options outside the granted session scope (e.g., a FileTransfer session attempting Remote session controls). Monitoring these logs can help detect exploitation attempts.

While no explicit commands are provided in the resources, administrators should check RustDesk server audit logs for entries labeled as SessionScopeViolation or related permission audit events.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade RustDesk to version 1.4.9 or later, which includes fixes enforcing session scope permission checks and auditing to prevent unauthorized control message injection.

This update restricts UI elements and control options to their appropriate session types, triggers alarms on scope violations, and disconnects offending sessions, thereby mitigating the risk of privilege escalation.

Additionally, reviewing and monitoring audit logs for session scope violations can help detect and respond to any exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in RustDesk before version 1.4.9 allows an authenticated remote peer to bypass session scope restrictions, potentially gaining unauthorized control and observation capabilities beyond their granted permissions.

Such unauthorized access and control could lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA, as sensitive information might be exposed or manipulated without proper authorization.

The fix introduced in RustDesk 1.4.9 enforces strict session scope permission checks, auditing, and disconnection on violations, which helps mitigate risks related to unauthorized access and supports compliance with security and privacy regulations.

Useful 0 Not Useful 0