CVE-2020-0919
📋 TL;DR
This vulnerability allows attackers to load unsigned binaries in Microsoft Remote Desktop App for Mac, potentially enabling privilege escalation. It affects users running vulnerable versions of the Remote Desktop App on macOS systems. Successful exploitation could allow an attacker to execute arbitrary code with elevated privileges.
💻 Affected Systems
- Microsoft Remote Desktop App for Mac
📦 What is this software?
Windows App by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full system control by loading malicious unsigned binaries with elevated privileges, potentially leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Local attacker or malware with initial access escalates privileges to install persistent backdoors, access sensitive data, or bypass security controls.
If Mitigated
With proper patch management and least privilege principles, impact is limited to isolated incidents that can be quickly contained and remediated.
🎯 Exploit Status
Requires local access or ability to execute code on the target system. No public exploit code was disclosed at the time of advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 10.3.7 or later
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0919
Restart Required: Yes
Instructions:
1. Open Microsoft Remote Desktop App for Mac. 2. Go to Help > Check for Updates. 3. Install version 10.3.7 or later. 4. Restart the application.
🔧 Temporary Workarounds
Disable or Remove Vulnerable Application
allUninstall Microsoft Remote Desktop App for Mac if not required, or restrict its use to non-privileged accounts.
sudo rm -rf /Applications/Microsoft\ Remote\ Desktop.app
Implement Application Whitelisting
allUse macOS security features or third-party tools to restrict execution of unsigned binaries.
🧯 If You Can't Patch
- Run Remote Desktop App with non-administrative privileges only
- Implement strict endpoint detection and monitoring for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Microsoft Remote Desktop App version in the application's About dialog or via: mdls -name kMDItemVersion /Applications/Microsoft\ Remote\ Desktop.appCheck Version:
mdls -name kMDItemVersion /Applications/Microsoft\ Remote\ Desktop.app 2>/dev/null || echo "Application not found"Verify Fix Applied:
Verify version is 10.3.7 or higher using the same command and ensure the application has been restarted.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Remote Desktop App context
- Privilege escalation attempts in system logs
- Loading of unsigned binaries by rdclient processes
Network Indicators:
- Unusual outbound connections from rdclient processes
- Lateral movement attempts following privilege escalation
SIEM Query:
process_name:"rdclient" AND (event_type:"process_execution" OR event_type:"privilege_escalation")