CVE-2021-42098
📋 TL;DR
This vulnerability in Devolutions Remote Desktop Manager allows attackers to bypass permission checks via batch custom PowerShell scripts. Attackers could execute unauthorized actions that should be restricted by user permissions. Organizations using affected versions of Remote Desktop Manager are at risk.
💻 Affected Systems
- Devolutions Remote Desktop Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized access to sensitive systems and credentials managed by Remote Desktop Manager, potentially leading to lateral movement and full network compromise.
Likely Case
Privilege escalation within Remote Desktop Manager allowing unauthorized access to credentials and connections that should be restricted.
If Mitigated
Limited impact with proper network segmentation and least privilege access controls in place.
🎯 Exploit Status
Exploitation requires some level of access to the system but the bypass mechanism is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.2.16 and later
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2021-0006
Restart Required: Yes
Instructions:
1. Download and install Remote Desktop Manager version 2021.2.16 or later from Devolutions website. 2. Close all Remote Desktop Manager instances. 3. Run the installer. 4. Restart the application.
🔧 Temporary Workarounds
Disable batch custom PowerShell
windowsTemporarily disable batch custom PowerShell functionality until patching can be completed.
Navigate to Administration > Security > Security Settings > Disable 'Allow batch custom PowerShell'
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual PowerShell execution patterns
- Segment Remote Desktop Manager systems from critical infrastructure and implement network monitoring
🔍 How to Verify
Check if Vulnerable:
Check Remote Desktop Manager version in Help > About. If version is below 2021.2.16, the system is vulnerable.Check Version:
In Remote Desktop Manager: Help > About displays current versionVerify Fix Applied:
Verify version is 2021.2.16 or higher in Help > About and test permission enforcement on batch PowerShell entries.📡 Detection & Monitoring
Log Indicators:
- Unusual PowerShell execution patterns in Remote Desktop Manager logs
- Permission bypass attempts in security logs
Network Indicators:
- Unexpected connections from Remote Desktop Manager systems to sensitive targets
SIEM Query:
source="RemoteDesktopManager" AND (event_type="PowerShell_execution" OR event_type="permission_bypass")