By Keren Pollack, on June 20th, 2019

 

POLICY DESCRIPTION:

Specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. You can use this setting to prevent users from redirecting clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows clipboard redirection. If the status is set to Enabled, users cannot redirect clipboard data. If the status is set to Disabled, Remote Desktop Services always allows clipboard redirection. If the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level. However, an administrator can still disable clipboard redirection using the Remote Desktop Session Host Configuration tool.

 

POTENTIAL VULNERABILITY:

Microsoft’s clipboard sharing channel supports several data formats such as CF_HDROP that is responsible for the “Copy & Paste” feature. When used, it allows us to simply copy a group of files from one computer to the other. If the client itself fails to prevent malicious files from entering his computer via this feature, he could be vulnerable to a path traversal attack. The server can then drop malicious files in arbitrary paths on the client’s computer. In other words, the client’s approval of the files is the only thing protecting him from this vulnerability. Considering the fact that the client doesn’t even need to verify the received files coming from the RDP server, it is almost impossible to detect the attack.

BlueKeep- Don’t let your RDP be the next breach’s smoking gun

COUNTERMEASURES:

If you’ve decided that some users do need the clipboard function enabled, it is recommended to segment the LANs that have RDP clipboard enabled, so they can be tracked.

 

POTENTIAL IMPACT:

As simple as it sounds, remote users won’t be able to use the clipboard functionality. That may lead to damage in production for applications that rely on this ability.

RDP clipboard vulnerability

SEVERITY:

Critical

 

RECOMMENDED VALUE:

Enable

 

HOW TO CONFIGURE:

 

Windows 2016 server:

In Windows 2016, these settings are controlled within Group Policy.

  1. Launch “msc“.
  2. Navigate to “Computer Configuration” > “Administrative Templates” > “Windows Components” > “Remote Desktop Services” > “Remote Desktop Session Host“.
  3. Ensure “Do not allow Clipboard redirection” is set to “Enabled“.

Windows 2012 server:

  1. Open “Server Manager“.
  2. Select “Remote Desktop” Services.
  3. Select “Collections“.
  4. Select “Tasks“, then choose “Edit Properties“.
  5. Under the “Client Settings” tab, ensure the “Clipboard” and “Drive” are disabled.

Windows 2008 server:

  1. Launch “Remote Desktop Session Host Configuration” from the server.
  2. Under “Connections“, right-click the connection and select “Properties“.
  3. Select the “Client Settings” tab, and make sure the “Clipboard” box is checked. If you don’t want to allow copying and pasting of files, make sure the Drive selection is checked. Click OK when done.

 

AUTOMATE YOUR SERVER HARDENING:

Server hardening can be a painful procedure. If you’re reading this article, you probably already know it. Endless hours, labor and money are invested in this process, which can often result in production breakdown despite the effort to prevent it. CSH by CalCom is automating the entire server hardening process. CHS’s unique ability to ‘learn’ your network abolishes the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production hassle-free. want to know more?

Click here and get the datasheet.