A significant vulnerability has been identified in TeamViewer, a widely used remote support software that facilitates desktop sharing and full control over systems across the globe. This security flaw poses a severe risk as it potentially allows users involved in a shared session to assume unauthorized control of each other’s computers.
TeamViewer enables users to collaborate and provide technical assistance securely over the Internet. The software requires both participants—the presenter and the viewer—to have it installed, along with the sharing of a confidential authentication code by the client who wishes to grant access.
However, a GitHub user named “Gellin” has revealed a critical flaw that could permit the client, who is sharing the desktop session, to take control over the viewer’s machine without any authorization. This vulnerability highlights a significant breach in the expected security protocols of the software.
Gellin has also provided a proof-of-concept, delivering a C++ DLL exploit that utilizes “naked inline hooking and direct memory modification” to manipulate TeamViewer permissions. Both the client and the server can exploit this injectable code, leading to two alarming scenarios.
In one scenario, if a server exploits this vulnerability, they can re-enable the “switch sides” feature after it has been authenticated by the client. This means servers can subsequently change control without explicit permission. In another scenario, if the client is the one exploiting the vulnerability, they may take control of both mouse and keyboard inputs of the server, disregarding any existing permissions revoked by the server.
This vulnerability affects all versions of TeamViewer operating on Windows, macOS, and Linux systems. The issue was initially disclosed by a Reddit user identified as “xpl0yt,” who confirmed that the TeamViewer security team acknowledged the flaw and has since initiated a corrective patch for Windows.
According to a spokesperson from TeamViewer, “We are patching versions 11-13. Windows updates are already available, while those for MacOS and Linux are expected to be released later today.” TeamViewer users are advised to install these patches immediately upon availability. For those who have set their software to receive automatic updates, the patches will be applied without manual intervention.
The incident exemplifies persistent cybersecurity concerns that can arise even from trusted software applications, highlighting the need for business owners to remain vigilant and proactive in safeguarding their systems against emerging threats. The risks presented by this vulnerability align with several tactics outlined in the MITRE ATT&CK framework, including initial access through unauthorized privileges and potential exploitation methods for system manipulation.
As businesses increasingly rely on remote collaboration tools, understanding and mitigating these vulnerabilities becomes crucial in maintaining operational security and protecting sensitive information.