Microsoft Windows 10 1803/Server 2019 RDP Session Lockscreen authentication bypass

Summaryinfo

A vulnerability identified as critical has been detected in Microsoft Windows 10 1803/Server 2019. Affected by this vulnerability is an unknown functionality of the component RDP Session Handler. The manipulation leads to authentication bypass (Lockscreen). This vulnerability is traded as CVE-2019-9510. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply the suggested workaround.

Detailsinfo

A vulnerability was found in Microsoft Windows 10 1803/Server 2019 (Operating System). It has been rated as critical. This issue affects some unknown functionality of the component RDP Session Handler. The manipulation with an unknown input leads to a authentication bypass vulnerability (Lockscreen). Using CWE to declare the problem leads to CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a temporary RDP disconnect, Automatic Reconnection of the RDP session will be restored to an unlocked state, regardless of how the remote system was left. By interrupting network connectivity of a system, an attacker with access to a system being used as a Windows RDP client can gain access to a connected remote system, regardless of whether or not the remote system was locked. This issue affects Microsoft Windows 10, version 1803 and later, and Microsoft Windows Server 2019, version 2019 and later.

The weakness was shared 01/15/2020 as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. The identification of this vulnerability is CVE-2019-9510 since 03/01/2019. The attack may be initiated remotely. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/16/2020).

It is possible to mitigate the problem by applying the configuration setting Disable RDP.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 1803
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion