Vulnerability in Remote Desktop Commander Suite Agent

IF a customer a.) installed our Agent service in the default path C:\Programs\RDPSoft\Remote Desktop Reporter Agent and b.) has not softened the standard Windows NTFS permissions in the root of C:\ or under the C:\Programs folder. By default, standard users do not have permission to create new files in the root of C: or in the Program Files folder and its subfolders. If our agent service has been installed in a different folder and/or the default NTFS permissions have been weakened, this may result in the unquoted service path being exploited.

Twitter
LinkedIn
Facebook

Vulnerability type

Vulnerability in the unquoted service path

Pentester

Florian Hansemann

Publication

09.02.2022

Software version

Remote Desktop Commander Suite Agent <= Version 4.8

Timeline

– 12.11.2021 Seller informs

– 10.12.2021 The seller has confirmed the problem and requests a release on February 9, 2022

– 09.02.2022 Disclosure