Security issue - Bypass permissions

[RAZ0RBECK]

Hello ,
I have been using nightly version 1.2.0 for some time now and I found this flaw that allows me to change the settings of the PC I connected to without having any permission (Enable remote configuration modification).

How to reproduce:

• Connect to a computer using Rustdesk;
• open Rustdesk on that computer (you should now see the program screen blurred if you do not have permission to change the configuration);
• to bypass this obfuscation, simply move your pointer to any icon in the program window in the upper right-hand corner; then slowly move the cursor down ( you may need to repeat several times);
  -You can now change any of the program settings.

Tested on both Windows and Linux.
I haven't tested the stable version.

[rustdesk]

Honestly, we know this flaw. But if you wanna modify security related settings, you need addministrative priviledge (if installed).

https://api.flutter.dev/flutter/widgets/FocusTraversalGroup-class.html
flutter/flutter#45102

[RAZ0RBECK]

Thank you for the fast reply, yes this is true for linux, unfortunately on a stock windows you only need to press 'yes' to grant admin permission. Today I tried to connect to a stable version (1.1.9), the problem is not present.

[ForsakenRei]

Thank you for the fast reply, yes this is true for linux, unfortunately on a stock windows you only need to press 'yes' to grant admin permission. Today I tried to connect to a stable version (1.1.9), the problem is not present.

I see your point. Though for windows this only applies to admin account. If you are using admin account then UAC will only ask you yes or no but not asking for password again(hell, for everything not only Rustdesk). When using a standard account, UAC will ask username and password.

[bigretromike]

I wanted to report this, but looks like someone was first :-)

[Kurgan-]

You can also use cursor keys to move inside of the rustdesk window leaving the mouse cursor on the title bar. I have just tried it and it worked, I modified the config avoiding the "greyout" of the rustdesk window.
Or you can put the mouse inside of the window (that turns gray) and then still move around using cursor keys and enter key to enable/disable functions.

[JReming85]

Another bypass I just found, if you hover over the window it will darken to prevent access.

With your mouse over the window, press the Windows key to open the start menu and you can now click any of the buttons on the window. Unhide password, 3 dot menu + enable remote config access, etc.

[bigretromike]

So maybe moving setting under button in popup window? so if you click it you need UAC ?

[sevk]

really need this security feature?

[rustdesk]

Even we fix above, touch mode on mobile still can bypass this. We may remove this feature.