My first time playing with a RemoteApp, and it really wasn't isolated like it should be
Try harding an internal path traversal until it leaked every user's data
One little header to drop the whole firewall, then a nice chain all the way to RCE
Starting from a site that looked totally empty, and ending up with a nice RCE