Executive brief
VNCAuthProxy is a reverse proxy used to protect VNC (Virtual Network Computing) sessions by requiring authentication before allowing connections. This vulnerability allows remote attackers to bypass authentication entirely and connect directly to protected VNC servers without providing any credentials, potentially gaining unauthorized access to remote desktop sessions or disrupting legitimate users.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the RFB (Remote FrameBuffer) security handshake implementation within vncap/vnc/protocol.py's VNCServerAuthenticator component. A remote attacker with network access to the proxy server can exploit this flaw to connect to any VNC server protected by the proxy without providing authentication credentials. The vulnerability affects all versions through 1.1.1, and patches are available in version 1.2.0 and later. No special preconditions beyond network reachability are required.
Affected products
- OSU Open Source Lab VNCAuthProxy through 1.1.1
Timeline
- 2022-09-14: disclosed: NVD publication date
- 2022-09-16: disclosed: GHSA publication date
- 2022-09-16: patched: Fix committed; version 1.2.0 available