SecBoard
Zurück zur CVE-Übersicht

CVE-2026-100417

LOW(3.1)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Risk Signal Score8/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

3.1

Technische Schwere

Beschreibung

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 1.5.0

Threat-Hunting-Queries

Detects attempts to read clipboard files via FormatDataRequest or FileContentsRequest messages when one-way file transfer is enabled. This requires deep packet inspection or application-level logging of RustDesk communication.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName == "rustdesk.exe"
| where ProcessCommandLine contains "FormatDataRequest" or ProcessCommandLine contains "FileContentsRequest" // Placeholder: Actual detection requires network traffic analysis or RustDesk internal logs.
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=* sourcetype=rustdesk_logs (FormatDataRequest OR FileContentsRequest) | table _time, host, source, dest, user, action, message

Sigma

title: RustDesk Clipboard File Request Bypass
status: experimental
description: Detects attempts to bypass one-way file transfer in RustDesk by requesting clipboard files.
references:
  - https://www.vulncheck.com/advisories/rustdesk-before-1.5.0-one-way-file-transfer-bypass
logsource:
  category: network_connection
  product: rustdesk # Placeholder: Requires custom RustDesk logging or deep packet inspection
detection:
  selection:
    EventID: 12345 # Placeholder: Replace with actual RustDesk log event ID for clipboard requests
    Message|contains_all:
      - 'FormatDataRequest'
      - 'FileContentsRequest'
  condition: selection
fields:
  - SourceIp
  - DestinationIp
  - SourcePort
  - DestinationPort
  - ProcessName
level: low

Elastic ES|QL

from network.connection
| where process.name == "rustdesk.exe" // Placeholder: Requires custom RustDesk logging or deep packet inspection
| where message : "FormatDataRequest" or message : "FileContentsRequest"
| select @timestamp, host.name, process.name, source.ip, destination.ip, source.port, destination.port, message

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • f299fb9906006247863250d7dfaa016f29eef7a4

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen