RDS Clipboard Redirection: Should you allow it?

In this article, we will provide basic information regarding the Clipboard Redirection setting, which enables the copy and paste function in remote desktop. Once you have decided on the setting’s desired value, be sure to test it thoroughly to understand its impact on your production fully. This is critical since you don’t want it to result in damage to production. Configuring Remote Desktop Service (RDS) Clipboard Redirection settings is a fundamental step in the hardening project.

What You Will Learn

• What is RDS Clipboard Redirection
• Why is this feature is vulnerable
• How attackers exploit this vulnerability 
• Steps to mitigate the risks
• How to configure RDS clipboard redirection
  

What is Clipboard Redirection

The Remote Desktop Protocol (RDP), also known as mstsc (named after Microsoft’s built-in RDP client), is a protocol developed by Microsoft that is commonly used by IT staff or technical users to connect to or work on a remote computer.  After successfully connecting an RDP client to a remote RDP server installed on the remote computer, the client gains access to the remote server and can control it, depending on the user’s permissions. This can also be done in the opposite direction, where the client machine can be attached and taken over.

The RDS Clipboard Redirection setting allows or prevents the clipboard on the user device from being mapped to the clipboard on the server. The “Do not allow Clipboard redirection” setting specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. To prevent cut-and-paste data transfer between a session and the local clipboard, select Prohibit. By default, clipboard redirection is allowed.

Image: Architecture of Microsoft’s RDP clipboard sharing

You can set the following statuses

• If the status is set to Enabled, users cannot redirect clipboard data.
• When Disabled, Remote Desktop Services always allows clipboard redirection (this is the default behavior).
• If the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level.

However, an administrator can still disable clipboard redirection using the Remote Desktop Session Host Configuration tool.

Clipboard Redirection Vulnerability

Microsoft’s clipboard sharing channel supports several data formats, such as CF_HDROP, which is responsible for the “Copy & Paste” feature. When used, it allows us to easily copy a group of files from one computer to another. If the client itself fails to prevent malicious files from entering its computer via this feature, it could be vulnerable to a path traversal attack. The server can then drop malicious files in arbitrary paths on the client’s computer. In other words, the client’s approval of the files is the only thing protecting him from this vulnerability. Considering the fact that the client doesn’t even need to verify the received files coming from the RDP server, it is almost impossible to detect the attack.

Mitagation

Attackers commonly use RDP for malicious activity; therefore, it is recommended to configure the Remote Desktop Server to only allow required tasks. If you’ve decided that some users do need the clipboard function enabled, it is recommended to segment the LANs that have RDP clipboard enabled so that they can be tracked and managed effectively. 

• Potential Impact: As simple as it sounds, remote users won’t be able to use the clipboard functionality. This may lead to production damage for applications that rely on this ability.
• Severity: Critical
• Recommended Value: Enable

Configuring Clipboard Redirection

Windows Server 2016

1. Launch “msc“.
2. Navigate to “Computer Configuration” > “Administrative Templates” > “Windows Components” > “Remote Desktop Services” > “Remote Desktop Session Host“.
3. Ensure “Do not allow Clipboard redirection” is set to “Enabled“.

Windows Server 2012

1. Open “Server Manager“.
2. Select “Remote Desktop” Services.
3. Select “Collections“.
4. Select “Tasks“, then choose “Edit Properties“.
5. Under the “Client Settings” tab, ensure the “Clipboard” and “Drive” are disabled.

Windows Server 2008

1. Launch “Remote Desktop Session Host Configuration” from the server.
2. Under “Connections“, right-click the connection and select “Properties“.
3. Select the “Client Settings” tab and ensure the “Clipboard” box is checked. If you don’t want to allow copying and pasting of files, make sure the Drive selection is checked. Click OK when done.

Key Takeaways

• Clipboard redirection is a dangerous attack vector
• This feature is vulnerable to a path traversal attack
• Attackers exploit clipboard sharing to move sensitive information or inject malicious code
• Disabling clipboard redirection mitigates vulnerabilities
• CalCom’s CHS automates RDS server hardening

CalCom’s RDS Server Hardening Automation

After years of hardening using traditional manual tools, we concluded that utilizing hardening automation tools is essential for achieving a successful hardening project and maintaining a good compliance posture. Since the testing process is complex and prone to human error, we recommend automating the entire hardening process to minimize security risks.

CalCom offers a fully automated server hardening tool – CHS. CHS’s unique ability to ‘learn’ your network eliminates the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production servers, hassle-free.

Learn more about server hardening automation.