Affected Windows Server families include:

Systems that have installed Microsoft's January 2020 security updates or later cumulative updates should contain the relevant fixes.

Why UDP/3391 Instead of HTTPS/443?

An RD Gateway deployment can expose multiple related services.

For example:

The RDWeb portal may be visible through a browser at:

and RD Gateway functionality may also be exposed through TCP/443.

However, the attack surface tested by this BlueGate-style validator is the RD Gateway UDP transport, normally listening on:

The scanner therefore uses DTLS over UDP/3391, not HTTPS over TCP/443.

Changing the script to port 443 would mean testing:

which is not the same thing as:

Confirming the RD Gateway UDP Service

Before running the vulnerability validator, UDP/3391 can be checked with Nmap:

Example:

The savant service label is simply Nmap's port-name mapping and does not necessarily identify the actual service.

The RD Gateway DTLS service can be confirmed more reliably with OpenSSL.

DTLS 1.0

DTLS 1.2

A successful handshake confirms that a DTLS service is responding on UDP/3391.

Typical successful output includes:

or:

What This Tool Does

The validator:

1. Starts an OpenSSL DTLS client.
2. Connects to the target RD Gateway over UDP/3391.
3. Waits for the DTLS handshake to complete.
4. Sends a single BlueGate-style fragmentation validation packet.
5. Waits for the RD Gateway application response.
6. Extracts the final status DWORD from a 16-byte response.
7. Classifies the response.

No authentication credentials are required for the validation.

The utility intentionally contains:

Requirements

Tested with:

Verify OpenSSL:

Verify Python:

No Python OpenSSL module is required because the script launches the system openssl s_client implementation.

This avoids compatibility problems encountered by older BlueGate implementations that relied on deprecated Python/OpenSSL APIs such as:

Usage

Basic scan:

Example:

The default destination is:

Specify Port

DTLS 1.0

DTLS 1.2

Testing both can be useful:

Patched Example

Example result from a patched RD Gateway:

The same patched response may also be returned over DTLS 1.0:

Understanding the Result

0x8000ffff

A response ending with:

is the rejection value used by public BlueGate/RD Gateway scanners to identify the malformed fragmentation condition as rejected.

The tool therefore reports:

This provides strong protocol-level evidence that the particular condition tested for CVE-2020-0609/CVE-2020-0610 is not exploitable using the known public detection technique.

Different 16-byte Status

If a 16-byte RD Gateway response is received but the final DWORD is something other than:

the tool reports:

This should be treated as:

rather than immediate proof of successful remote code execution.

The result should preferably be corroborated using:

before reporting the vulnerability as definitively exploitable.

No Response

If no application response is received:

The tool deliberately does not classify a timeout as vulnerable.

A timeout could be caused by:

• firewall behavior
• UDP packet loss
• DTLS incompatibility
• network filtering
• application behavior
• service configuration

Therefore:

Detection Logic

The public BlueGate/RDG detection approach uses an RD Gateway fragmentation packet containing an unusual fragment count.

Conceptually:

The validation packet used by this utility is sent only once.

Legal Disclaimer

This project is intended exclusively for:

• authorized penetration testing
• vulnerability validation
• defensive security research
• lab environments
• educational security research

Only test systems for which you have explicit authorization.

The author assumes no responsibility for misuse, unauthorized access, service disruption, data loss, or other consequences resulting from use or modification of this software.

Credits

The detection methodology is based on publicly documented research into the Microsoft RD Gateway vulnerabilities CVE-2020-0609 and CVE-2020-0610, including the work performed by the BlueGate and RD Gateway security research community.

This project primarily modernizes the validation workflow by using the system OpenSSL DTLS implementation rather than deprecated pyOpenSSL DTLS internals.