CVE-2022-23613

HIGH

Privilege escalation on xrdp

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-23613 has a selected CVSS score of 7.8 (high); EIP currently links 1 curated repository PoC.

Description

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

xrdp

Browse neutrinolabs / xrdp
CVE List>= 0.9.17, < 0.9.18.1affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2025-68670Curated repository PoCby exploitintel8Exploit880 files

C · 16.0 MiB · linked to 5 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a fully functional remote exploit for CVE-2025-68670, a pre-authentication stack-based buffer overflow in xrdp. It includes multiple Python scripts that implement a complete RDP handshake to deliver a malicious payload, overwrite the return address, and redirect execution to attacker-chosen addresses within the xrdp binary, achieving instruction pointer control.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of Python scripts and documentation for a CVE-2025-68670 proof-of-concept exploit targeting a stack-based buffer overflow in xrdp. The scripts implement a legitimate RDP handshake to deliver a malicious domain field, causing a crash or redirecting execution to specific addresses within the xrdp binary. No concealed backdoor, credential theft, persistence mechanism, or unrelated payload was observed. The behavior is consistent with a standard security research PoC.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarexrdp
Attack typesStack-based Buffer OverflowRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is classified as an exploit because it contains complete, functional code that actively exploits a vulnerability to achieve a security impact beyond simple detection. The script `exploit/exploit.py` is explicitly designed to 'Redirect execution to arbitrary functions in the binary's .text section' and 'Demonstrate... Instruction Pointer Control + Code Execution Redirection'. It performs a full RDP handshake, sends a crafted payload to trigger a stack-based buffer overflow, and overwrites the return address to hijack the control flow of the xrdp process.

exploit/exploit.py:1-28exploit/exploit.py:399-410exploit/exploit.py:563-567

Requirements

  • Network access to the target xrdp service on TCP port 3389.exploit/exploit.py:9
  • The target xrdp binary must be compiled without stack canary protection (-fno-stack-protector) and without PIE (-no-pie).README.md:170

Observed behavior

  • Initiates a TCP connection to the target and performs a complete, legitimate RDP protocol handshake (X.224, MCS Connect Initial, Channel Join) to reach the vulnerable code path.exploit/exploit.py:227-288
  • Constructs a malicious domain string containing a leading underscore, padding, and a double-underscore delimiter. This string is encoded as UTF-16LE and sent within the RDP TS_INFO_PACKET.exploit/exploit.py:163-220
  • The overflow overwrites saved callee-saved registers (RBX, RBP, R12-R15) and performs a 3-byte partial overwrite of the saved return address on the stack, redirecting execution to a chosen address in the binary's .text section (e.g., printf@plt).exploit/exploit.py:11-14README.md:340-349
  • Completes the RDP handshake by sending Confirm Active, Synchronize, Control, and Font List PDUs, which triggers the vulnerable function and the subsequent crash or code redirection.exploit/exploit.py:301-345
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the expected behavior for a PoC targeting CVE-2025-68670. The scripts send a crafted domain field to cause a crash or redirect execution to attacker-chosen addresses within the xrdp binary.exploit/exploit.py:34-35poc/crash_poc.py:5-14poc/control_flow_probe.py:1-8
Target Addresses
Payload withheldThese addresses are used to demonstrate instruction pointer control by redirecting execution to known functions within the vulnerable xrdp process. This is a standard technique for proving control flow hijacking.exploit/exploit.py:141-146poc/control_flow_probe.py:112-134
Bypass Attempt
Payload withheldThis is a secondary PoC targeting a related but distinct vulnerability. It does not introduce backdoor behavior; it attempts to trigger a heap overflow in a patched version of the software.poc/bypass_poc.py:1-48
Review boundaries

What the analysis did not establish

  • The evidence packet reports 23 binary files that were not analyzed, including compiled executables and core dumps. The analysis is based solely on the provided readable text files.
  • The analysis scope indicates 'complete_artifact_coverage: false', meaning not all files in the artifact were inspected.
  • 23 binary files were present in the artifact but were not analyzed per the evidence envelope's binary policy. Their contents could not be inspected for backdoor behavior.
  • The review is limited to the supplied text evidence; any behavior triggered only at runtime under specific conditions not described in the scripts would not be detected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4