DELINEA PROTOCOL HANDLER - RETURN OF THE MSI: RCE VIA CUSTOM LAUNCHER

Summary from the TLDR InfoSec newsletter

AmberWolf disclosed an RCE vulnerability in Delinea's Secret Server Protocol Handler (≤6.0.3.39) and Connection Manager (≤2.7.1) where improper sanitisation of the sslauncher:// URL handler's generic process launcher allowed a malicious server to supply attacker-controlled process names and arguments via encrypted launcher data, achieving arbitrary code execution on both Windows and macOS when a victim visits a crafted webpage and accepts a security prompt. The exploit, implementable as a NachoVPN plugin, abuses the legitimate key exchange flow to inject serialized launcher configurations that RDPWin.exe blindly executes via Process.Start(). Delinea patched the protocol handler as of January 17. Organizations should upgrade immediately and monitor for anomalous child processes spawned by RDPWin.exe.