Proof-of-concept (PoC) exploits have been released for two recently patched Remote Desktop Gateway vulnerabilities that can be exploited for remote code execution.
Remote Desktop Gateway (RD Gateway) is a Windows Server component previously known as Terminal Services Gateway. The use of RD Gateway, which provides RDP routing, should reduce the attack surface as organizations don’t have to directly expose their RDP servers to the internet. Remote users connect to the gateway, which forwards RDP traffic to the desired address.
However, Microsoft researchers discovered that RD Gateway is affected by two critical memory corruption vulnerabilities that can be exploited by a remote, unauthenticated attacker to execute arbitrary code by sending specially crafted requests to the targeted system via RDP. No user interaction is required for exploitation.
The flaws, tracked as CVE-2020-0610 and CVE-2020-0609, affect Windows Server 2012, 2016 and 2019. Microsoft patched them with its January 2020 security updates, which the company released on January 14.
A technical analysis of the vulnerabilities was published just a few days later by researcher Marcus Hutchins and several PoC exploits have now been created.
Hutchins, aka MalwareTech, has made public the source code for a scanner that allows users to check if their servers are vulnerable.
A Denmark-based researcher who uses the online moniker Ollypwn has released a PoC exploit that uses CVE-2020-0609 and CVE-2020-0610 to cause a denial-of-service (DoS) condition. Ollypwn named the vulnerabilities BlueGate.
Researcher Luca Marcelli says he has created a working PoC that achieves remote code execution, but he has yet to make his exploit public. The expert will soon publish a blog post describing his work.
In his own blog post, Hutchins explained that the vulnerabilities affect the RD Gateway code responsible for handling UDP. RD Gateway also supports HTTP and HTTPS, and disabling UDP or firewalling the associated UDP port should be enough to prevent exploitation in the case of users who are unable to immediately install Microsoft’s patches.
It’s important that users take measures to prevent exploitation of these vulnerabilities since RDP-related weaknesses can be a tempting target for malicious actors. For example, hackers started exploiting the Windows Remote Desktop Services (RDS) vulnerability tracked as BlueKeep several months after Microsoft released a patch.
Related: PoC Exploits Released for Crypto Vulnerability Found by NSA
Related: PoC Exploits Created for Wormable Windows RDS Flaw
Related: PoC Exploits Published for Unpatched RCE Bugs in rConfig
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Microsoft: No-Interaction Outlook Zero Day Exploited Since Last April
- US to Adopt New Restrictions on Using Commercial Spyware
- Hackers Earn Over $1 Million at Pwn2Own Exploit Contest
- GoAnywhere Zero-Day Attack Hits Major Orgs
- Australia Dismantles BEC Group That Laundered $1.7 Million
- ‘Grim’ Criminal Abuse of ChatGPT is Coming, Europol Warns
- Webinar Tomorrow: Understanding Hidden Third-Party Identity Access Risks
- GitHub Rotates Publicly Exposed RSA SSH Private Key
