Private tunnel identifier may be included in the non-private details of active connections

Vulnerability

Apache Guacamole versions 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses [1]. This affects authenticated users who have permission to access a particular connection; the bug occurs when the server returns information about active connections, exposing the internal tunnel identifier that should remain private.

Exploitation

An attacker must be an authenticated user of Apache Guacamole with permission to access the same connection as the victim. Exploitation requires the attacker to call the vulnerable REST endpoint(s) that return details of active connections, where the private tunnel identifier is inadvertently included in non-private fields [1]. No additional privileges or user interaction beyond authentication are needed.

Impact

If exploited, an attacker can read or interact with another user's active use of the same connection [1]. This can lead to information disclosure (observing another user's session activity) and potential manipulation of the shared connection, depending on the capabilities of the protocol or application being accessed through Guacamole.

Mitigation

Upgrade to Apache Guacamole 1.4.0 or later, which contains the fix for this issue [1]. No workarounds are documented in the available references.