Description (CNA)
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| RustDesk / RustDesk | affected 0 through 1.4.8; unaffected 1.4.9 |
CWE
CWE-863
References
- https://github.com/bikini/exploitarium/tree/main/rustdesk-session-permission-pocs
- https://www.vulncheck.com/advisories/rustdesk-filetransfer-session-authorization-scope-bypass
ADP enrichment
No English description supplied.
No references supplied.