VMware Horizon Community
EricNichols
Hot Shot
Hot Shot

Security issue, Linux View Client argument --once AKA "Exit on disconnect or when an error occurs connecting to a desktop."

Client stays open and if you ignore the Close button, another user can start another session as the original user. SSO credential are not being discarded based on connection server global settings.

While connected to a VM on one computer, when stealing that VM sesson from another computer, I would expect the View Client to close after being disconnected on the original computer when using the --single argument.

Instead, the client on the original computer stays open and displays a red banner with a close button. The text in the banner reads "The connection to the remote computer has been closed due to a new connection request.". If you click close, the client closes but if you ignore the close button, any user can come along and start a new session or steal your existing session by clicking on the underlying pool icons.

Additionally, the connection server has the default 15 minute cached single sign on credential setting. But, even after days, the client with the red banner can connect to another session using the previously stored credentials.

For now I can add this to a background job:

(while :; do if [ -f /tmp/vmware-root/vmware-horizon-client-*.log ]; then (tail -f -n0 /tmp/vmware-root/vmware-horizon-client-*.log) | grep -q "changed: DISCONNECTED" && pkill vmware-view; fi; sleep 15; done)&

0 Kudos
0 Replies