Impact

The xrdp-sesman service can be crashed by connecting over port 3350 and supplying a malicious payload.

Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to:

• Capture any user credentials that are submitted to XRDP.
• Approve or reject arbitrary login credentials. For xorgxrdp sessions, in particular, this allows an unauthorized user to hijack an existing session.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4044