CVE-2024-52940

Executive Summary

CVE-2024-52940 identifies a privacy vulnerability in AnyDesk for Windows (versions through 8.1.0). When the "Allow Direct Connections" feature is enabled, the application inadvertently leaks the victim's public IP address within network traffic. An attacker who already knows the victim's AnyDesk ID can exploit this to determine the victim's public IP, bypassing the intended anonymity of the remote access protocol. This information disclosure can be used for geolocation tracking, targeted attacks, or as a precursor to further network-based exploitation. The vulnerability has a low EPSS score (0.0%) and no known public exploit code, but the attack vector is straightforward and requires only passive network observation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned, likely due to incomplete data)
• Threat Level: Medium (Information Disclosure)
• Attack Vector (AV): Network (Adjacent or Remote, depending on attacker position)
• Attack Complexity (AC): Low (requires only knowledge of AnyDesk ID)
• Privileges Required (PR): None
• User Interaction (UI): None (victim does not need to interact)
• Scope (S): Unchanged
• Confidentiality (C): Low (IP address disclosure)
• Integrity (I): None
• Availability (A): None

Deep Dive & Mechanics

AnyDesk uses a proprietary protocol for peer-to-peer connections. When "Allow Direct Connections" is enabled, the client attempts to establish a direct UDP/TCP connection to the remote peer, bypassing the relay server. This direct connection requires the client to know the remote peer's public IP address. The vulnerability lies in the fact that the AnyDesk client, during the connection setup, transmits the victim's public IP address in cleartext or in a manner that is easily observable by an attacker who is passively monitoring the network traffic between the victim and the AnyDesk infrastructure.

The attacker's workflow:

1. Obtain the victim's AnyDesk ID (e.g., through social engineering, leaked databases, or prior compromise).
2. Initiate a connection attempt to the victim's AnyDesk ID.
3. The victim's AnyDesk client, with "Allow Direct Connections" enabled, will respond with its public IP address as part of the direct connection negotiation.
4. The attacker captures this IP address from the network traffic.

This is not a remote code execution or privilege escalation; it is a privacy leak that exposes the victim's public IP.

Vulnerable vs. Patched Code

No official patch has been released by AnyDesk. The vulnerable code is within the AnyDesk client's network stack, specifically in the module handling direct connection negotiation. The fix would involve either:

• Disabling the direct connection feature by default.
• Encrypting the IP address exchange during the connection setup.
• Using a relay server for all connections, even when direct connections are allowed.

Since no patched version is available, a code comparison is not possible.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• AnyDesk installed on attacker machine (any version).
• Victim's AnyDesk ID.
• Network access to the victim (the victim must be reachable, or the attacker must be able to observe traffic to/from the AnyDesk relay).

Steps:

1. Setup Network Capture: On the attacker machine, start a packet capture tool (e.g., Wireshark, tcpdump) to monitor traffic to and from the AnyDesk relay servers (typically *.anydesk.com).
2. Initiate Connection: Use AnyDesk to attempt a connection to the victim's ID. The victim does not need to accept the connection; the IP leak occurs during the initial handshake.
3. Analyze Traffic: In the captured packets, look for UDP or TCP packets containing the victim's public IP address. The IP will appear in the payload of the AnyDesk protocol packets.
4. Extract IP: The victim's public IP address will be visible in the packet payload.

Example (using tcpdump):

# Capture traffic to AnyDesk servers
sudo tcpdump -i eth0 host anydesk.com -w anydesk_capture.pcap
# After initiating connection, analyze with tshark
tshark -r anydesk_capture.pcap -Y "udp.port == 7070" -T fields -e data.text

Blue Team (Defender)

Detection:

• Monitor for outbound connections to AnyDesk relay servers (*.anydesk.com) from internal hosts.
• Look for AnyDesk client processes initiating connections without user interaction.
• Use network monitoring to detect AnyDesk protocol traffic that contains IP addresses in cleartext.

Mitigation:

• Disable "Allow Direct Connections" in AnyDesk settings.
• Use a firewall to block direct peer-to-peer connections (e.g., block UDP ports 7070, 50000-50010).
• Implement network segmentation to limit exposure of internal hosts.
• Educate users about the risks of enabling direct connections.

Indicators of Compromise (IOCs)

• Network Traffic:
  • UDP packets to/from AnyDesk relay servers (e.g., relay.anydesk.com, *.anydesk.com) containing cleartext IP addresses.
  • AnyDesk protocol packets with a specific pattern indicating a direct connection request.
• Processes:
  • AnyDesk.exe (Windows) running with network activity.
• Registry (Windows):
  • HKEY_CURRENT_USER\Software\AnyDesk\Settings\allow_direct_connections set to 1.

Detection Engineering

YARA Rule

rule AnyDesk_IP_Leak_CVE_2024_52940 {
    meta:
        description = "Detects AnyDesk network traffic containing cleartext IP addresses indicative of CVE-2024-52940"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-52940"
    strings:
        $anydesk_magic = { 41 6E 79 44 65 73 6B } // "AnyDesk" in hex
        $ip_pattern = /\b(?:\d{1,3}\.){3}\d{1,3}\b/
    condition:
        $anydesk_magic and #ip_pattern > 0
}

Sigma Rule

title: AnyDesk Direct Connection IP Leak (CVE-2024-52940)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic from AnyDesk that may contain cleartext IP addresses due to CVE-2024-52940.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52940
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|endswith: '.anydesk.com'
        DestinationPort: 7070
    condition: selection
falsepositives:
    - Legitimate AnyDesk connections
level: medium

Suricata Rule

alert udp $HOME_NET any -> $EXTERNAL_NET 7070 (msg:"AnyDesk Direct Connection IP Leak (CVE-2024-52940)"; content:"|41 6E 79 44 65 73 6B|"; pcre:"/\b(?:\d{1,3}\.){3}\d{1,3}\b/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Disable Direct Connections: In AnyDesk settings, uncheck "Allow Direct Connections". This forces all traffic through the relay server, preventing IP leakage.
2. Firewall Rules: Block outbound UDP ports 7070 and 50000-50010 to prevent direct peer-to-peer connections.
3. Network Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on AnyDesk traffic patterns.
4. User Awareness: Educate users not to enable direct connections unless absolutely necessary.
5. Vendor Patch: Monitor AnyDesk for an official patch that encrypts the IP exchange or disables the feature by default.

Valters IT