Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in xrdp allows an unauthenticated attacker to tamper with encrypted remote desktop traffic without detection. Because the Message Authentication Code signature check is missing for the \"Classic RDP Security\" layer, modifications to data in transit will go unnoticed. This could lead to unauthorized data manipulation or unauthorized access to sensitive systems.
- Attackers can modify traffic.
- This affects remote desktop sessions.
- Requires man-in-the-middle capabilities.
Attack Path
How an attacker could exploit the issue
An attacker with man-in-the-middle capabilities could exploit this vulnerability to tamper with encrypted RDP traffic without detection. By bypassing the Message Authentication Code (MAC) validation, they could alter data packets in transit, potentially leading to unauthorized access or modification of the remote system. This attack requires the Classic RDP Security layer to be in use, not TLS.
- Network access needed.
- Modifies encrypted RDP traffic.
- Classic RDP security layer used.
Live Threat
Current exploitation, exposure, and threat context
Attackers are unlikely to prioritize weaponizing this vulnerability due to the specific network conditions required for exploitation. The vulnerability is confined to the "Classic RDP Security" layer and does not affect TLS-enforced connections, which are often the default or recommended configuration for secure remote access. This specificity limits its broad applicability.
- Requires MITM on classic RDP.
- TLS enforcement bypasses the flaw.
- Affects older xrdp versions.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize upgrading xrdp to version 0.10.6 or newer to address the critical vulnerability in its MAC signature verification for encrypted RDP packets. If an immediate upgrade is not feasible, enforce TLS security by configuring `security_layer=tls` in `xrdp.ini` to mitigate the risk of attackers modifying traffic in transit.
- Upgrade xrdp to 0.10.6.
- Configure `security_layer=tls` if upgrading is delayed.
- Monitor network traffic for anomalies.
