TSPlus 16.0.0.0 – Remote Work Insecure Credential storage
# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://tsplus.net/ # Version: Up to 16.0.0.0 # Tested on: Windows # CVE : CVE-2023-31069 With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single sign-on web portal and remote desktop gateway that enables users to remotely access the console session of their office PC. It is possible to create a custom web portal login page which allows a user to login without providing their credentials. However, the credentials are stored in an insecure manner since they are saved in cleartext, within the html login page. This means that everyone with an access to the web login page, can easely retrieve the credentials to access to the application by simply looking at the html code page. This is a code snippet extracted by the source code of the login page (var user and var pass): // --------------- Access Configuration --------------- var user = "Admin"; // Login to use when connecting to the remote server (leave "" to use the login typed in this page) var pass = "SuperSecretPassword"; // Password to use when connecting to the remote server (leave "" to use the password typed in this page) var domain = ""; // Domain to use when connecting to the remote server (leave "" to use the domain typed in this page) var server = "127.0.0.1"; // Server to connect to (leave "" to use localhost and/or the server chosen in this page) var port = ""; // Port to connect to (leave "" to use localhost and/or the port of the server chosen in this page) var lang = "as_browser"; // Language to use var serverhtml5 = "127.0.0.1"; // Server to connect to, when using HTML5 client var porthtml5 = "3389"; // Port to connect to, when using HTML5 client var cmdline = ""; // Optional text that will be put in the server's clipboard once connected // --------------- End of Access Configuration --------------- |