In this article we will provide basic information regarding the Clipboard Redirection setting, which enables the copy past function in remote desktop. Once you have decided the setting’s desired value, be sure and test it to fully understand what will be its impact on your production. This is critical since you don’t want it to result in damage to production.
Configuring Remote Desktop Service (RDS) Clipboard Redirection settings is a fundamental step in the hardening project.
What is Clipboard Redirection:
RDS Clipboard Redirection setting prevents or allows the clipboard on the user device being mapped to the clipboard on the server. The "Do not allow Clipboard redirection" setting specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. To prevent cut-and-paste data transfer between a session and the local clipboard, select Prohibit. By default, clipboard redirection is allowed
The Remote Desktop Protocol (RDP), also known as mstsc (named after Microsoft's built-in RDP client), is a protocol developed by Microsoft that is commonly used by IT staff or technical users to connect to or work on a remote computer. After successfully connecting a RDP client to a remote RDP server, that is installed on the remote computer the client gains access to the remote server and can control it, depending on the user's permissions. This can also be done in the opposite direction where the client machine can be attached and taken over.
Image: Architecture of the Microsoft’s RDP clipboard sharing
*If the status is set to Enabled, users cannot redirect clipboard data.
*When Disabled, Remote Desktop Services always allows clipboard redirection (this is the default behavior).
*If the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level. However, an administrator can still disable clipboard redirection using the Remote Desktop Session Host Configuration tool.
Clipboard Redirection Potential Vulnerability:
Microsoft's clipboard sharing channel supports several data formats such as CF_HDROP, which is responsible for the "Copy & Paste" feature. When used, it allows us to simply copy a group of files from one computer to the other. If the client itself fails to prevent malicious files from entering his computer via this feature, he could be vulnerable to a path traversal attack. The server can then drop malicious files in arbitrary paths on the client's computer. In other words, the client's approval of the files is the only thing protecting him from this vulnerability. Considering the fact that the client doesn't even need to verify the received files coming from the RDP server, it is almost impossible to detect the attack.
Mitigating Clipboard Redirection Vulnerability:
attackers commonly use RDP for malicious activity, therefore it is recommended to configure the Remote Desktop Server to only allow required tasks. If you've decided that some users do need the clipboard function enabled, it is recommended to segment the LANs that have RDP clipboard enabled, so they can be tracked.
Potential Impact of Clipboard Redirection Disabling:
As simple as it sounds, remote users won't be able to use the clipboard functionality. That may lead to damage in production for applications that rely on this ability.
Vulnerability Severity:
Critical
CalCom’s RECOMMENDED VALUE:
Enable
HOW TO CONFIGURE Clipboard Redirection:
Windows 2016 server:
In Windows 2016, these settings are controlled within Group Policy.
- Launch "msc".
- Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Remote Desktop Services" > "Remote Desktop Session Host".
- Ensure "Do not allow Clipboard redirection" is set to "Enabled".
Windows 2012 server:
- Open "Server Manager".
- Select "Remote Desktop" Services.
- Select "Collections".
- Select "Tasks", then choose "Edit Properties".
- Under the "Client Settings" tab, ensure the "Clipboard" and "Drive" are disabled.
Windows 2008 server:
- Launch "Remote Desktop Session Host Configuration" from the server.
- Under "Connections", right-click the connection and select "Properties".
- Select the "Client Settings" tab, and make sure the "Clipboard" box is checked. If you don't want to allow copying and pasting of files, make sure the Drive selection is checked. Click OK when done.
Server Hardening Automation:
After years of hardening using the traditional manual tools, we concluded that using hardening automation tools is essential for achieving a successful hardening project and a good compliance posture. Since the testing process is complex and prone to human error, we recommend automating the entire hardening process. CalCom offers a fully automated server hardening tool – CHS. CHS's unique ability to 'learn' your network eliminates the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production servers, hassle-free.
Learn more about server hardening automation.
