Summary
RustDesk mishandles session authorization by gating control messages on per-capability flags instead of the authenticated connection type, allowing scope creep between features.
Under certain conditions, a peer with only file-transfer permission can still send keyboard and mouse input and access screenshot or display-capture handlers, operating beyond its intended privileges.
RustDesk mishandles session authorization by gating control messages on per-capability flags instead of the authenticated connection type, allowing scope creep between features.
Under certain conditions, a peer with only file-transfer permission can still send keyboard and mouse input and access screenshot or display-capture handlers, operating beyond its intended privileges.
Affected context
This vulnerability appears in RustDesk sessions where different capabilities—such as file transfer, remote control, and screen capture—share authorization state but are not rigorously isolated.
It is relevant when a peer is granted a limited authorization type (for example, FileTransfer-only) yet the session continues to honor residual control flags for input and display-capture features.
Deployments that rely on fine-grained permissions for remote assistance or support workflows are most exposed to this mis-enforced authorization logic.
This vulnerability appears in RustDesk sessions where different capabilities—such as file transfer, remote control, and screen capture—share authorization state but are not rigorously isolated.
It is relevant when a peer is granted a limited authorization type (for example, FileTransfer-only) yet the session continues to honor residual control flags for input and display-capture features.
Deployments that rely on fine-grained permissions for remote assistance or support workflows are most exposed to this mis-enforced authorization logic.
Exploit preconditions
- Attack surface: Active RustDesk session between a controlling peer and a target system
- Required access: Possession of valid FileTransfer authorization or similar limited session credentials
- Trigger point: Sending control messages (keyboard, mouse, or capture-related requests) while connected under a file-transfer session
- Why exploitation is possible: Capability gating is based on lingering flags rather than the actual authorized connection type, and a file-transfer session does not reset or compartmentalize those flags, allowing the peer to reach handlers outside its granted scope
- Attack surface: Active RustDesk session between a controlling peer and a target system
- Required access: Possession of valid FileTransfer authorization or similar limited session credentials
- Trigger point: Sending control messages (keyboard, mouse, or capture-related requests) while connected under a file-transfer session
- Why exploitation is possible: Capability gating is based on lingering flags rather than the actual authorized connection type, and a file-transfer session does not reset or compartmentalize those flags, allowing the peer to reach handlers outside its granted scope
Why this happens
The underlying issue is an authorization design flaw where access checks do not strictly bind actions to the authenticated session type.
Instead of enforcing a clear separation between file-transfer-only sessions and full remote-control sessions, RustDesk relies on per-capability flags that can remain set or be reused across different authorization contexts.
This maps to CWE-863: Incorrect Authorization, in which the system fails to verify that the current operation is permitted for the specific role or connection type, allowing a lower-privileged peer to trigger higher-privileged handlers such as input injection and display capture.
The underlying issue is an authorization design flaw where access checks do not strictly bind actions to the authenticated session type.
Instead of enforcing a clear separation between file-transfer-only sessions and full remote-control sessions, RustDesk relies on per-capability flags that can remain set or be reused across different authorization contexts.
This maps to CWE-863: Incorrect Authorization, in which the system fails to verify that the current operation is permitted for the specific role or connection type, allowing a lower-privileged peer to trigger higher-privileged handlers such as input injection and display capture.
Potential impact
- A file-transfer-only peer may inject keyboard input, including sensitive commands or shortcuts
- A peer could move or click the mouse, manipulating UI elements and configuration dialogs
- The attacker can access screenshot or display-capture handlers, potentially viewing on-screen sensitive information
- Misuse of remote sessions could lead to configuration changes, data exfiltration, or indirect code execution via the user interface
- A file-transfer-only peer may inject keyboard input, including sensitive commands or shortcuts
- A peer could move or click the mouse, manipulating UI elements and configuration dialogs
- The attacker can access screenshot or display-capture handlers, potentially viewing on-screen sensitive information
- Misuse of remote sessions could lead to configuration changes, data exfiltration, or indirect code execution via the user interface
General mitigation guidance
Effective mitigation focuses on strict, role-based enforcement of session capabilities and clear separation of authorization contexts.
Common defensive patterns include:
- Tying every control handler (keyboard, mouse, capture, file transfer) to the current session's authenticated connection type, not to shared or lingering flags
- Implementing explicit privilege boundaries so that capabilities cannot silently expand beyond the scope initially granted
- Resetting or re-evaluating capability state when session modes change, and ensuring no overlap between low-privilege and high-privilege handlers
- Applying least-privilege defaults for new sessions, enabling only the minimal necessary capabilities and requiring explicit elevation for remote control or display capture
Effective mitigation focuses on strict, role-based enforcement of session capabilities and clear separation of authorization contexts.
Common defensive patterns include:
- Tying every control handler (keyboard, mouse, capture, file transfer) to the current session's authenticated connection type, not to shared or lingering flags
- Implementing explicit privilege boundaries so that capabilities cannot silently expand beyond the scope initially granted
- Resetting or re-evaluating capability state when session modes change, and ensuring no overlap between low-privilege and high-privilege handlers
- Applying least-privilege defaults for new sessions, enabling only the minimal necessary capabilities and requiring explicit elevation for remote control or display capture
How teams detect issues like this
Organizations can detect and prevent similar authorization flaws through:
- Targeted code review that traces how session types, capability flags, and handlers are wired together, verifying that each action checks the correct authorization source
- Static analysis rules that flag access-control decisions made purely on mutable flags without referencing the authenticated identity or role
- Architectural security reviews focused on privilege boundaries between features like file transfer, remote control, and monitoring
- Policy enforcement in CI pipelines that require explicit authorization checks for any handler that affects user input, display content, or system configuration; automated tools may assist by annotating and verifying access-control paths
Organizations can detect and prevent similar authorization flaws through:
- Targeted code review that traces how session types, capability flags, and handlers are wired together, verifying that each action checks the correct authorization source
- Static analysis rules that flag access-control decisions made purely on mutable flags without referencing the authenticated identity or role
- Architectural security reviews focused on privilege boundaries between features like file transfer, remote control, and monitoring
- Policy enforcement in CI pipelines that require explicit authorization checks for any handler that affects user input, display content, or system configuration; automated tools may assist by annotating and verifying access-control paths
