CVE-2024-35164 Overview
CVE-2024-35164 affects the terminal emulator in Apache Guacamole 1.5.5 and earlier. The vulnerability stems from improper validation of console codes received from servers over text-based protocols such as SSH. An attacker with access to a text-based connection can send a crafted sequence of console codes to trigger arbitrary code execution in the context of the guacd process. The flaw is tracked under [CWE-129: Improper Validation of Array Index]. Apache addressed the issue in Guacamole 1.6.0.
Critical Impact
A malicious server or man-in-the-middle attacker on a text-based connection can execute arbitrary code with the privileges of the running guacd daemon.
Affected Products
- Apache Guacamole 1.5.5
- Apache Guacamole versions prior to 1.5.5
- Apache Guacamole guacd component (terminal emulator)
Discovery Timeline
- 2025-07-02 - CVE-2024-35164 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35164
Vulnerability Analysis
Apache Guacamole is a clientless remote desktop gateway that proxies protocols including SSH, Telnet, RDP, and VNC through a browser. The guacd daemon parses and renders text-based sessions using an embedded terminal emulator. The emulator interprets ANSI escape and console control sequences to update the display state.
The vulnerability arises because the terminal emulator does not properly validate numeric parameters embedded within console codes. Server-supplied indexes and lengths flow into internal arrays without bounds checking, matching the [CWE-129] pattern of improper array index validation. A crafted sequence delivered from a malicious SSH or Telnet endpoint can corrupt memory inside guacd and steer execution.
Successful exploitation grants code execution under the identity of the guacd process. This process typically brokers all remote sessions on a Guacamole host, so compromise exposes credentials, session tokens, and any downstream systems reachable from the gateway.
Root Cause
The root cause is missing validation of console code parameters supplied by the remote server. The terminal emulator trusts server-provided indices, treating them as safe inputs to array operations rather than as adversary-controlled data.
Attack Vector
An attacker must control or coerce a Guacamole user into connecting to a text-based service they operate. Once the SSH or Telnet session is established, the malicious endpoint streams a crafted escape sequence back to the client. The guacd process parses the sequence and executes attacker-controlled code. Because Guacamole users typically initiate outbound connections to arbitrary hosts, low-privileged Guacamole accounts are sufficient to reach a hostile server.
No verified public proof-of-concept code is available. For additional protocol-level details, see the Apache Mailing List Thread and the OpenWall OSS Security Update.
Detection Methods for CVE-2024-35164
Indicators of Compromise
- Unexpected child processes spawned by the guacd daemon, such as shells or network utilities.
- Outbound network connections initiated by guacd to hosts that are not configured Guacamole targets.
- Crashes or restarts of guacd logged in system journals following text-based (SSH or Telnet) sessions.
Detection Strategies
- Monitor process ancestry on Guacamole hosts and alert when guacd forks non-standard binaries.
- Inspect SSH and Telnet traffic captured by the gateway for unusually long or malformed CSI and OSC escape sequences.
- Correlate Guacamole session logs with endpoint telemetry to identify sessions preceding anomalous guacd behavior.
Monitoring Recommendations
- Enable verbose logging in guacd and forward logs to a central SIEM for retention and search.
- Track the Guacamole package version across all gateway hosts and flag any instance still running 1.5.5 or earlier.
- Baseline outbound connections from Guacamole servers and alert on deviations.
How to Mitigate CVE-2024-35164
Immediate Actions Required
- Upgrade Apache Guacamole to version 1.6.0 or later on all gateway hosts.
- Restrict which downstream hosts Guacamole users can reach through connection group and permission controls.
- Run guacd under a dedicated, unprivileged service account isolated from other workloads.
Patch Information
Apache released Guacamole 1.6.0 to fix this issue. The patched release replaces the terminal emulator parsing logic with validated bounds checks on console code parameters. Administrators should redeploy both the guacamole-server (which contains guacd) and the guacamole-client web application to matching versions. Refer to the Apache Mailing List Thread for the vendor advisory.
Workarounds
- Disable SSH and Telnet connection types in Guacamole until the upgrade to 1.6.0 is complete.
- Restrict Guacamole users to a curated allowlist of internal SSH targets to prevent connections to attacker-controlled hosts.
- Place guacd behind egress filtering that blocks arbitrary outbound destinations from the gateway host.
# Verify installed Guacamole server version and upgrade path
guacd -v
# Expected output after remediation: Apache Guacamole 1.6.0 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
