ebrasha/abdal-anydesk-remote-ip-detectorCVE-2024-52940 - A zero-day vulnerability in AnyDesk's "Allow Direct Connections" feature, discovered and registered by Ebrahim Shafiei (EbraSha), exposing public and private IP addresses. For details, visit the NVD, Tenable, or MITRE pages.
To see the AnyDesk IP Leak Vulnerability in action, you can download the PoC demonstration videos below:
These videos showcase how the vulnerability operates, illustrating the steps and impact on IP address privacy.
The Abdal AnyDesk Remote IP Detector is a Proof-of-Concept (PoC) tool that exploits a Zero-Day vulnerability discovered on October 27, 2024, in AnyDesk’s "Allow Direct Connections" feature. When this option is enabled, and the connection port is set to 7070 on the attacker's system only, it allows an attacker to retrieve the public IP address of a target using only the AnyDesk ID, without any configuration changes on the target system. Additionally, if both systems are on the same network, the attacker can also obtain the target’s private IP address.
This Zero-Day vulnerability in AnyDesk's "Allow Direct Connections" feature exposes sensitive IP information of the target. Attackers can exploit this flaw to retrieve the public IP address, and, in specific cases, the private IP address of the target system. This vulnerability poses significant privacy risks, particularly when security configurations are insufficiently protected in remote access tools.
When the Allow Direct Connections option is enabled on the attacker’s system, AnyDesk inadvertently exposes the target’s public IP address in network traffic. This IP address can be easily identified through network sniffing on the attacker’s system. If both systems are on the same local network, the target’s private IP address may also be accessible. The image below demonstrates the network traffic capture using the Abdal Sniffer tool, highlighting how this information is exposed.
This vulnerability has been officially registered as CVE-2024-52940.
It was submitted and registered under the name of Ebrahim Shafiei (EbraSha) by NIST (National Institute of Standards and Technology), Tenable, and MITRE, a U.S. government advisory organization in scientific and technical domains.
For more information, visit:
There are no specific prerequisites needed to run this PoC.
To download the executable versions of this PoC, please visit the official Releases page on GitHub. This will allow you to obtain the compiled version ready for use:
The tool will output:
This vulnerability affects AnyDesk version 8.1.0 and below. As of now, there is no fixed version released to address this issue.
Unfortunately, there is currently no user-side fix for this vulnerability. To fully address this issue, an update or patch from AnyDesk’s development team is required.
If you find this project helpful and would like to support further development, please consider making a donation:
Handcrafted with Passion by Ebrahim Shafiei (EbraSha)
If you encounter any issues or have configuration problems, please reach out via email at [email protected]. You can also report issues on GitLab or GitHub.
This Proof of Concept (PoC) is provided for educational purposes only. Unauthorized use of this code on systems you do not own or have explicit permission to test is illegal and unethical. By using this PoC, you agree to take full responsibility for any misuse or damage that may result. The author disclaims all liability for actions taken based on the information provided in this repository. Always ensure you have proper authorization before conducting any security testing.
