RustDesk 1.2.3/1.3.6.1.5.5/7.3.3 on Windows certificate validation ⚔ [Disputed]

Summaryinfo

A vulnerability classified as critical has been found in RustDesk 1.2.3/1.3.6.1.5.5/7.3.3 on Windows. The impacted element is an unknown function. The manipulation leads to certificate validation. This vulnerability is uniquely identified as CVE-2024-25140. No exploit exists. The real existence of this vulnerability is still doubted at the moment.

Detailsinfo

A vulnerability was found in RustDesk 1.2.3/1.3.6.1.5.5/7.3.3 on Windows. It has been rated as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is confidentiality. The summary by CVE is:

A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.

The weakness was disclosed 02/06/2024. It is possible to read the advisory at news.ycombinator.com. The identification of this vulnerability is CVE-2024-25140. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• RustDesk

Version

• 1.2.3
• 1.3.6.1.5.5
• 7.3.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion