Critical Vulnerability Found in AnyDesk: Attackers Can Gain Admin Privileges

A critical security vulnerability has been discovered in the popular remote access software AnyDesk. Identified as CVE-2024-12754, this flaw allows attackers to access system files and escalate privileges, potentially leading to full administrative control of the affected system.

Exploitation of File Copy Mechanism
The vulnerability was discovered by security researcher Naor Hodorov and revolves around the file copying mechanism used by the AnyDesk service running on Windows systems. When a new session is initiated, AnyDesk copies the current desktop wallpaper to the C:\Windows\Temp folder. This process allows low-privileged users to read and potentially control certain files within this folder.

Unauthorized File Access and Privilege Escalation
A low-privileged user can manipulate the process by changing the desktop wallpaper and controlling which file gets copied to C:\Windows\Temp. However, the copied file is only accessible by system administrators and NT AUTHORITY\SYSTEM. To bypass this restriction, an attacker can place a file with the same name in the C:\Windows\Temp directory before the copy operation, allowing them to access the copied file.

Additionally, attackers can exploit the Windows-created HarddiskVolumeShadowCopy (Shadow Copies) mechanism to access system files. Following these steps, attackers can elevate their local privileges:

1. Place a file with the target name in C:\Windows\Temp beforehand.
2. Trigger the copy operation using an oplock (file lock).
3. Redirect the folder containing the wallpaper to the NT Object Manager Namespace.
4. Use shadow copies to access SAM, SYSTEM, and SECURITY files.
5. Gain administrator privileges by utilizing the obtained data.

Disclosure Timeline
The vulnerability was reported to AnyDesk developers on July 24, 2024. After being tracked through Trend Micro’s Zero Day Initiative (ZDI), the flaw was publicly disclosed on December 19, 2024. Details about the CVE and ZDI can be found through the provided link.

To prevent exploitation of this vulnerability, AnyDesk users are advised to follow updates and review their system security settings promptly.