CVE-2024-12149
📋 TL;DR
This vulnerability allows authenticated users in Devolutions Remote Desktop Manager to request temporary permissions on entries and receive higher privileges than requested due to incorrect permission assignment. It affects Windows installations of Remote Desktop Manager version 2024.3.19.0 and earlier.
💻 Affected Systems
- Devolutions Remote Desktop Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated user could escalate privileges to administrative levels, potentially gaining full control over the Remote Desktop Manager instance and accessing all managed credentials and connections.
Likely Case
Users with standard access could gain elevated permissions to view or modify entries they shouldn't have access to, leading to credential exposure or unauthorized system access.
If Mitigated
With proper access controls and monitoring, impact would be limited to temporary privilege misuse that could be detected and revoked.
🎯 Exploit Status
Exploitation requires authenticated access but appears straightforward based on the vulnerability description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3.20.0 or later
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2024-0017
Restart Required: Yes
Instructions:
1. Download latest version from Devolutions website
2. Run installer to upgrade existing installation
3. Restart Remote Desktop Manager service
🔧 Temporary Workarounds
Disable temporary access requests
windowsTemporarily disable the temporary access requests feature to prevent exploitation
Navigate to Administration > Security Settings > Temporary Access and disable the feature
🧯 If You Can't Patch
- Restrict user permissions to minimum required levels
- Implement strict monitoring of permission changes and access logs
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Remote Desktop Manager for version numberCheck Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 2024.3.20.0 or later in Help > About📡 Detection & Monitoring
Log Indicators:
- Unusual permission escalation events
- Multiple temporary access requests from same user
- Access to entries outside normal user scope
Network Indicators:
- Not applicable - local application vulnerability
SIEM Query:
Search for 'temporary access' or 'permission escalation' events in application logs