CVE-2020-9498

Vulnerability

Apache Guacamole versions 1.1.0 and older contain a memory corruption vulnerability in the handling of pointers during processing of data received via RDP static virtual channels [1]. When a user connects to a malicious or compromised RDP server, specially crafted PDUs can trigger improper pointer manipulation, leading to memory corruption [1].

Exploitation

An attacker must first compromise an RDP server that a Guacamole user will connect to. The attacker then sends a series of specially crafted PDUs over the static virtual channel to the guacd process [1]. No additional authentication is required beyond the initial RDP connection; the user simply connects to the attacker-controlled server, triggering the vulnerable code path [1].

Impact

Successful exploitation allows arbitrary code execution with the privileges of the guacd process [1]. This can lead to full compromise of the Guacamole gateway, enabling the attacker to intercept and control all other connected sessions, potentially gaining access to sensitive data and systems [1].

Mitigation

Apache Guacamole released version 1.2.0 which fixes this vulnerability [1]. Users should upgrade to 1.2.0 or later. No workaround is available for earlier versions. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.