PT-2023-2696 · Microsoft · Remote Desktop Client+2

CVE-2023-24905 · Publicado 2023-05-09 · Atualizado 2024-05-29

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 version 22H2

Description The issue exists due to insufficient input validation in the Remote Desktop Client of the Windows operating system. This allows an attacker to execute arbitrary code, potentially impacting the system. The vulnerability can be exploited by chaining DLL Hijacking and Format String techniques, enabling remote code execution on the Windows RDP Client.

Recommendations For Windows 10 version 22H2, consider disabling the Remote Desktop Client until a patch is available to prevent potential exploitation. Restrict access to the Remote Desktop Client to minimize the risk of arbitrary code execution. Avoid using the Remote Desktop Client on devices with ARM architecture until the issue is resolved.

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-20

Identificadores relacionados

BDU:2023-02541

CVE-2023-24905

Produtos afetados

Remote Desktop Client

Windows

Windows 10

Referências · 15

• https://t.me/pentestingnews/36231 · Publicação no Telegram
• https://twitter.com/hetmehtaa/status/1690586923247812608 · Publicação no Twitter
• https://t.me/defcon_news/113411 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24905 · Nota de Segurança
• https://vuldb.com/ru/?id.228446 · Nota
• https://bdu.fstec.ru/vul/2023-02541 · Nota de Segurança
• https://t.me/ckure/12422 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-24905 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB20230509117 · Nota
• https://cyolo.io/blog/dll-hijacking-strikes-back-exploiting-windows-on-arm-rdp-client-cve-2023-24905 · Nota
• https://t.me/cybersecuritytechnologies/8358 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24905 · Aviso do Fabricante
• https://t.me/poxek/2923 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-24905 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24905 · Nota de Segurança