CVE-2022-33995
📋 TL;DR
This path traversal vulnerability in Devolutions Remote Desktop Manager allows attackers to create or overwrite arbitrary files on the system by manipulating entry attachments. It affects all users running versions before 2022.2, potentially enabling file system compromise.
💻 Affected Systems
- Devolutions Remote Desktop Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file creation/overwrite leading to remote code execution, data destruction, or privilege escalation.
Likely Case
Unauthorized file creation/modification in sensitive directories, potentially enabling persistence mechanisms or configuration tampering.
If Mitigated
Limited impact if proper file system permissions restrict write access to critical locations.
🎯 Exploit Status
Requires authenticated access to the Remote Desktop Manager interface to exploit the entry attachments feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.2 and later
Vendor Advisory: https://devolutions.net
Restart Required: Yes
Instructions:
1. Download and install Remote Desktop Manager version 2022.2 or later from Devolutions website. 2. Close all Remote Desktop Manager instances. 3. Run the installer. 4. Restart the application.
🔧 Temporary Workarounds
Disable entry attachments
allTemporarily disable the entry attachments feature to prevent exploitation.
Restrict file system permissions
allApply strict file system permissions to limit where the application can write files.
🧯 If You Can't Patch
- Implement strict access controls to limit who can use entry attachments feature.
- Monitor file system for unauthorized file creation/modification in sensitive directories.
🔍 How to Verify
Check if Vulnerable:
Check Remote Desktop Manager version in Help > About menu. If version is below 2022.2, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Confirm version is 2022.2 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation/modification events in application logs
- Multiple failed path traversal attempts
Network Indicators:
- Unusual file upload patterns to entry attachments
SIEM Query:
source="rdm_logs" AND (event="file_creation" OR event="file_modification") AND path CONTAINS ".."