Apache Guacamole Research Chains Protocol Injection With Use-After-Free

Summary

Stefan Schiller demonstrates how a Guacamole protocol parser mismatch can expose credentials and enable a use-after-free exploit, leading to code execution on the remote desktop gateway.

Key points

• A Java client and C server count certain Unicode characters differently, allowing a low-privileged user to inject protocol instructions through an image-type parameter.
• An injected connection instruction can redirect the server and expose connection settings, including credentials, to an attacker-controlled listener.
• The researcher used RDP drive redirection to read accessible server files and obtain process memory-layout information.
• A race involving audio-channel closure after disconnection creates a use-after-free condition; the researcher demonstrated it reliably with xrdp.
• The exploit used connection sharing to overcome heap arena separation and demonstrated code execution on the Guacamole server.
• Schiller recommends examining protocol specifications and using fuzzing to identify inconsistencies between parsers.