CVE-2024-12754

Executive Summary

CVE-2024-12754 is a local privilege escalation and information disclosure vulnerability in AnyDesk, a popular remote desktop application. The flaw resides in the handling of background images by the AnyDesk service. A local attacker with low-privileged code execution on the target system can exploit this by creating a junction (a symbolic link) to abuse the service's file access permissions. This allows the attacker to read arbitrary files on the system, including stored credentials from other applications or the operating system itself. The vulnerability has a CVSS score of 5.5 (Medium), but its potential to disclose credentials makes it a significant threat in post-exploitation scenarios. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a local binary vulnerability in the AnyDesk desktop application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond creating a junction.
• Privileges Required (PR): Low (L) – The attacker needs only low-privileged code execution.
• User Interaction (UI): None (N) – No user interaction is required for exploitation.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Arbitrary file read, including sensitive credentials.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to read arbitrary files and potentially steal credentials elevates the risk in targeted attacks, especially in enterprise environments where AnyDesk is used for remote support.

Deep Dive & Mechanics

The vulnerability is a classic "link following" or "junction" attack (CWE-59). The AnyDesk service runs with elevated privileges (likely SYSTEM or a high-integrity account) to manage remote connections and background images. When the service processes a background image file, it follows file system links without proper validation.

Attack Flow:

1. The attacker gains low-privileged code execution on the target system (e.g., via phishing, malware, or another vulnerability).
2. The attacker identifies a location where the AnyDesk service writes or reads background images (e.g., %PROGRAMDATA%\AnyDesk\backgrounds or a similar directory).
3. The attacker creates a junction (symbolic link) pointing from that expected background image path to a sensitive file, such as:
   • C:\Windows\System32\config\SAM (Windows password hashes)
   • %APPDATA%\Microsoft\Credentials\* (stored Windows credentials)
   • %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Login Data (Chrome saved passwords)
4. The AnyDesk service, running with high privileges, attempts to read the background image file. Due to the junction, it instead reads the target sensitive file.
5. The attacker can then access the contents of that file, either through the service's response or by monitoring the file system.

The vulnerability is particularly dangerous because it allows a low-privileged user to read files that are normally protected by higher integrity levels.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code is likely in the AnyDesk service's image loading routine. A patched version would need to:

• Use CreateFile with the FILE_FLAG_OPEN_REPARSE_POINT flag to prevent following junctions.
• Validate that the target file is within the expected directory and is a regular file, not a reparse point.
• Run the image loading operation at a lower integrity level or impersonate the user.

Vulnerable Code (Conceptual):

// Vulnerable: Follows junctions
HANDLE hFile = CreateFileW(
    L"C:\\ProgramData\\AnyDesk\\backgrounds\\bg.png",
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL
);

Patched Code (Conceptual):

// Patched: Does not follow junctions
HANDLE hFile = CreateFileW(
    L"C:\\ProgramData\\AnyDesk\\backgrounds\\bg.png",
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_FLAG_OPEN_REPARSE_POINT, // Do not follow reparse points
    NULL
);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local low-privileged code execution on a Windows system with AnyDesk installed.
• AnyDesk service running (default).

Steps:

1. Identify the background images directory. Common paths:
   • C:\ProgramData\AnyDesk\backgrounds
   • C:\Users\<username>\AppData\Roaming\AnyDesk\backgrounds
2. Create a junction from a background image file to a target sensitive file. For example, to read the SAM file:

   mklink /J C:\ProgramData\AnyDesk\backgrounds\bg.png C:\Windows\System32\config\SAM
   

3. Trigger the AnyDesk service to read the background image. This may happen automatically when a remote session starts or when the service initializes.
4. Monitor the file for changes or capture the output. The service may write the file contents to a log or return them in a response.

Note: No public exploit code is available. The above is a conceptual approach based on the vulnerability description.

Blue Team (Detection & Defense)

Detection:

• Monitor for the creation of junctions or symbolic links in AnyDesk directories.
• Alert on file reads from AnyDesk processes that target sensitive system files (e.g., SAM, SECURITY, NTDS.dit).
• Use Sysmon Event ID 1 (Process creation) and Event ID 11 (FileCreate) to track AnyDesk service activity.

Defense:

• Apply the principle of least privilege to the AnyDesk service.
• Use Windows Defender Application Control (WDAC) or AppLocker to restrict which processes can create junctions.
• Enable Windows Defender Credential Guard to protect stored credentials.
• Regularly update AnyDesk to the latest version once a patch is available.

Indicators of Compromise (IOCs)

• File System Artifacts:
  • Junctions or symbolic links in C:\ProgramData\AnyDesk\backgrounds\ or similar directories.
  • Unexpected file reads from AnyDesk.exe or AnyDeskService.exe to sensitive files (e.g., C:\Windows\System32\config\SAM).
• Process Activity:
  • AnyDesk.exe or AnyDeskService.exe accessing files outside of its expected working directory.
• Network Activity:
  • Unusual outbound connections from the AnyDesk process to external IPs (potential data exfiltration).

Detection Engineering

YARA Rule

rule CVE_2024_12754_AnyDesk_Junction_Exploit {
    meta:
        description = "Detects AnyDesk junction creation for CVE-2024-12754"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12754"
    strings:
        $junction_cmd = "mklink /J" nocase
        $anydesk_path = "AnyDesk" nocase
        $background_path = "backgrounds" nocase
    condition:
        $junction_cmd and $anydesk_path and $background_path
}

Sigma Rule

title: AnyDesk Junction Creation for CVE-2024-12754
id: 8a3f7c2e-1d4b-4f6a-9c8e-0b1a2d3e4f5a
status: experimental
description: Detects creation of junctions in AnyDesk directories, indicating exploitation of CVE-2024-12754.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12754
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'mklink'
            - '/J'
            - 'AnyDesk'
            - 'backgrounds'
    condition: selection
falsepositives:
    - Legitimate administrative use of junctions in AnyDesk directories (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12754 AnyDesk Potential Data Exfiltration"; flow:to_server,established; content:"AnyDesk"; http_client_body; content:"credentials"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Junction Creation: Use Group Policy or Windows Defender Application Control to prevent non-administrative users from creating junctions or symbolic links.
2. Monitor AnyDesk Activity: Enable detailed logging for the AnyDesk service and monitor for unusual file access patterns.
3. Apply Least Privilege: Run the AnyDesk service with the minimum necessary privileges. Consider using a dedicated low-privilege account.
4. Credential Protection: Enable Windows Defender Credential Guard and use LSA protection to mitigate credential theft.

Long-Term Fix:

• Await an official patch from AnyDesk. Once available, apply it immediately to all affected systems.
• Consider using alternative remote desktop solutions if a patch is not forthcoming.

Workaround:

• Disable the background image feature in AnyDesk settings if possible.
• Use file system auditing to detect junction creation in AnyDesk directories.

Valters IT
Securing Digital Frontiers