CVE-2023-31068

Executive Summary

CVE-2023-31068 exposes a critical misconfiguration in TSplus Remote Access (up to version 16.0.2.14) and TSplus Remote Work (up to version 16.0.0.0). The vulnerability stems from insecure file and folder permissions, where the Everyone group is granted Full Control over critical directories and files under %PROGRAMFILES(X86)%/TSplus/UserDesktop/themes and %PROGRAMFILES(X86)%/TSplus-RemoteWork/Clients/www. This allows any local user, including low-privileged accounts or malicious software, to read, modify, or delete sensitive files, including web application code, configuration files, and executable binaries. The impact is severe, enabling privilege escalation, persistent backdoor installation, and supply chain attacks against other users who download client software from the compromised web server.

Supply Chain & Package Security

This vulnerability directly impacts the supply chain of TSplus Remote Work. The Setup-RemoteWork-Client.exe installer, located in the download directory, is writable by Everyone. An attacker can replace this legitimate installer with a trojanized version. Any user who subsequently downloads and executes this installer from the TSplus web portal will be compromised, leading to a widespread supply chain attack.

CVSS Breakdown & Threat Level

CVSS Score: 7.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) - The attacker requires local access to the system.
• Attack Complexity (AC): Low (L) - No special conditions are required to exploit the weak permissions.
• Privileges Required (PR): Low (L) - The attacker only needs a standard user account.
• User Interaction (UI): None (N) - No user interaction is needed to exploit the file permissions.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the affected component.
• Confidentiality (C): High (H) - Full read access to all files, including source code and configuration.
• Integrity (I): High (H) - Full write access allows modification of any file.
• Availability (A): High (H) - Full delete access can cause denial of service.

Threat Level: Critical. The low attack complexity and high impact make this a prime target for post-exploitation activities and lateral movement.

Deep Dive & Mechanics

The root cause is a classic case of CWE-732: Incorrect Permission Assignment for Critical Resource. During installation, TSplus does not properly restrict the NTFS permissions on its installation directories. The Everyone group is granted Full Control (F) or (OI)(CI)(F) (Object Inherit, Container Inherit, Full Control) on a wide range of directories and files.

Technical Breakdown:

1. Directory Permissions ((OI)(CI)(F)): Directories like Clients/www and all its subdirectories inherit the Everyone:(OI)(CI)(F) permission. This means any new file or subdirectory created within these folders will also be fully accessible to everyone.
2. File Permissions ((F)): Specific files, including the client installer (Setup-RemoteWork-Client.exe), configuration files (.config), and JavaScript/HTML files, are directly assigned Everyone:(F).
3. Attack Vector: A local attacker (e.g., via a malicious script, a compromised user account, or malware) can:
   • Read source code (.js, .html) to find hardcoded credentials or business logic flaws.
   • Modify web pages to inject phishing forms or malicious scripts (e.g., keyloggers).
   • Replace the Setup-RemoteWork-Client.exe with a backdoored version.
   • Delete critical files to cause a denial of service.
   • Modify configuration files (.config) to alter application behavior, such as redirecting traffic or disabling security features.

Vulnerable vs. Patched Code

Vulnerable State (<= 16.0.2.14): The vulnerable state is defined by the insecure ACLs. There is no specific code to show, but the permission state can be verified.

# Check for vulnerable permissions on a directory
icacls "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www"
# Expected vulnerable output includes:
# Everyone:(OI)(CI)(F)

Patched State (UNKNOWN): A patch would involve removing the Everyone group from the ACLs and replacing it with more restrictive permissions, such as:

• BUILTIN\Administrators:(OI)(CI)(F)
• NT AUTHORITY\SYSTEM:(OI)(CI)(F)
• BUILTIN\Users:(OI)(CI)(RX) (Read & Execute only, where necessary)

# Example of a patched permission set
icacls "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www" /grant "BUILTIN\Administrators:(OI)(CI)(F)" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)(F)" /grant "BUILTIN\Users:(OI)(CI)(RX)" /inheritance:e

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install TSplus Remote Work v16.0.0.0 on a Windows 10/11 or Windows Server VM.
2. Create a standard local user account (e.g., testuser).
3. Log in as testuser.

Exploitation Steps:

The provided Exploit-DB code is a textual description of the vulnerability, not a functional exploit script. The exploitation is manual and relies on standard Windows commands.

1. Verify Permissions:

   icacls "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download\Setup-RemoteWork-Client.exe"
   

   Confirm the output includes Everyone:(F).

2. Backdoor the Installer (Supply Chain Attack):

   copy "C:\path\to\malicious\payload.exe" "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download\Setup-RemoteWork-Client.exe"
   

   Any user who downloads the client from the TSplus web portal will now receive the malicious file.

3. Modify Web Content (Phishing/Defacement):

   echo "<script>alert('XSS')</script>" >> "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\remoteapp\index.html"
   

4. Extract Sensitive Information:

   type "C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\hb.exe.config"
   

Blue Team (Defensive)

Detection & Response:

1. Audit Permissions: Regularly audit the ACLs on the TSplus installation directory.

   Get-ChildItem -Path "C:\Program Files (x86)\TSplus*" -Recurse | Get-Acl | Where-Object { $_.AccessToString -match "Everyone" }
   

2. File Integrity Monitoring (FIM): Monitor critical files for changes, especially Setup-RemoteWork-Client.exe and .config files.

   • Windows File Server Resource Manager (FSRM): Create file screens to block modifications to .exe and .config files in the TSplus directory by non-admin users.
   • Sysmon: Use Event ID 11 (FileCreate) and Event ID 2 (FileCreateStreamHash) to detect file creation/modification events in the TSplus directory.

3. Harden Permissions Immediately:

   # Remove Everyone from the entire TSplus directory tree
   icacls "C:\Program Files (x86)\TSplus-RemoteWork" /remove "Everyone" /t
   # Apply proper permissions
   icacls "C:\Program Files (x86)\TSplus-RemoteWork" /grant "BUILTIN\Administrators:(OI)(CI)(F)" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)(F)" /grant "BUILTIN\Users:(OI)(CI)(RX)" /inheritance:e
   

Indicators of Compromise (IOCs)

• File System IOCs:
  • Unauthorized modifications to files in C:\Program Files (x86)\TSplus*\
  • Presence of unexpected files (e.g., *.tmp, *.exe, *.ps1) in the TSplus directories.
  • Changes to the Setup-RemoteWork-Client.exe hash.
• Network IOCs:
  • Outbound connections from the TSplus server to unknown IPs (if a backdoor is installed).
  • Anomalous HTTP requests to the TSplus web portal (e.g., attempts to download modified files).
• Process IOCs:
  • cmd.exe or powershell.exe spawning from a non-admin user and accessing the TSplus directory.
  • icacls.exe or takeown.exe being executed by a non-admin user.

Detection Engineering

YARA Rule

rule CVE_2023_31068_TSplus_Insecure_Permissions {
    meta:
        description = "Detects insecure file permissions on TSplus directories"
        author = "Valters IT"
        date = "2024-05-24"
        reference = "CVE-2023-31068"
        hash = "N/A"
    strings:
        $s1 = "Everyone:(OI)(CI)(F)" ascii wide nocase
        $s2 = "Everyone:(F)" ascii wide nocase
        $s3 = "TSplus-RemoteWork" ascii wide nocase
        $s4 = "TSplus" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and
        (($s1 or $s2) and ($s3 or $s4))
}

Sigma Rule

title: TSplus Insecure File Permissions Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to modify files in the TSplus installation directory by non-admin users.
author: Valters IT
date: 2024/05/24
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31068
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Program Files (x86)\TSplus'
        User|endswith: 
            - 'Users'
            - 'Everyone'
    condition: selection
falsepositives:
    - Legitimate TSplus updates (should be run as SYSTEM or Administrator)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-31068 TSplus Supply Chain - Suspicious EXE Download"; flow:to_server,established; content:"GET"; http_method; content:"/download/Setup-RemoteWork-Client.exe"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually Fix Permissions: As a Blue Team action, immediately remove the Everyone group from the TSplus installation directories and apply restrictive permissions (Administrators: Full Control, Users: Read & Execute).
2. Isolate the Server: If the server is internet-facing, consider placing it behind a VPN or firewall to limit exposure.
3. Scan for Compromise: Check the integrity of all files in the TSplus directory, especially Setup-RemoteWork-Client.exe. Compare hashes against a known good version.

Long-Term Remediation:

1. Vendor Patch: Await an official patch from TSplus that corrects the installer to set proper permissions.
2. Configuration Management: Use Group Policy or a configuration management tool (e.g., Ansible, DSC) to enforce correct permissions on the TSplus directory.
3. Least Privilege: Ensure that the TSplus service runs with the minimum necessary privileges.
4. Monitoring: Implement continuous monitoring of file integrity and permission changes on the TSplus server.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: F36A6548AF39BE3A4A8FF45C] */}