CVE-2025-26318

Executive Summary

CVE-2025-26318 is an information disclosure vulnerability in TSplus Remote Access software, specifically within the hb.exe component. The flaw allows a remote, unauthenticated attacker to retrieve a list of all domain accounts currently connected to the application. This exposure of active user sessions can aid an attacker in reconnaissance, enabling targeted attacks such as credential theft, social engineering, or lateral movement within the network. The vulnerability has a CVSS score of 5.8 (Medium), and as of this report, no public exploit code or proof-of-concept is available. The vendor has released a patched version (17.30 2024-10-30), but the patch status for many deployments remains unknown.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a proprietary software component. The risk is primarily to organizations using TSplus Remote Access as a remote desktop gateway or application publishing solution.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Only a list of connected accounts is exposed.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service is possible.

Threat Level: Medium. While the direct impact is limited to information disclosure, the leaked data can be a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the hb.exe process, which is a core component of TSplus Remote Access responsible for handling remote connections and session management. The software exposes an endpoint or service that, when queried without authentication, returns a list of domain accounts currently logged into the application.

Root Cause: The hb.exe service fails to enforce authentication or authorization checks on a specific API call or RPC function that enumerates active user sessions. This allows any network-accessible client to request and receive the list of connected domain accounts.

Attack Vector: An attacker on the same network as the TSplus server (or over the internet if the service is exposed) can send a crafted request to the vulnerable service. The exact protocol (HTTP, RPC, custom TCP) is not publicly documented, but the response contains usernames in plaintext.

Impact: The attacker gains a real-time snapshot of active users, including their domain usernames. This information can be used to:

• Identify high-value targets (e.g., administrators).
• Perform password spraying or brute-force attacks against known usernames.
• Conduct social engineering attacks with context (e.g., "I see you are currently logged in...").
• Map the internal Active Directory structure.

Vulnerable vs. Patched Code

Since the exact code is proprietary, a direct code comparison is not possible. However, the fix likely involves adding authentication checks to the session enumeration endpoint.

Vulnerable Behavior (Pre-17.30 2024-10-30):

Request: GET /api/sessions (or similar)
Response: ["user1@domain.com", "admin@domain.com", "user2@domain.com"]

Patched Behavior (17.30 2024-10-30 and later):

Request: GET /api/sessions (or similar)
Response: 401 Unauthorized (or requires a valid session token)

The patch ensures that only authenticated users (or administrators) can query the list of active sessions.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Windows Server 2019/2022 with TSplus Remote Access version < 17.30 2024-10-30.
• Attacker: Kali Linux or any system with network access to the target.

Exploitation Steps:

1. Reconnaissance: Scan for TSplus services on port 443 (default HTTPS) or other custom ports.
2. Identify Endpoint: Use a tool like curl or netcat to probe for the session enumeration endpoint. Common paths might include /api/sessions, /hb/sessions, or a custom RPC call.
3. Extract Data: Send a request to the vulnerable endpoint.

   curl -k https://target-ip:443/api/sessions
   

   Or if it's a raw TCP service:

   echo "GET_SESSIONS" | nc target-ip 443
   

4. Parse Output: The response will contain a list of domain accounts.

   ["john.doe@corp.local", "jane.smith@corp.local", "admin@corp.local"]
   

Note: No public exploit code is available, so this is a generic approach based on the vulnerability description.

Blue Team (Defensive)

Detection & Response:

1. Monitor Network Traffic: Look for unusual requests to TSplus services, especially to unknown endpoints.
2. Check Logs: Review TSplus access logs for repeated requests to session enumeration endpoints from unknown IPs.
3. Harden Configuration: Ensure the TSplus service is not exposed to the internet unnecessarily. Use a VPN or firewall rules to restrict access.
4. Apply Patch: Immediately upgrade to version 17.30 2024-10-30 or later.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual HTTP GET requests to /api/sessions, /hb/sessions, or similar paths.
  • TCP connections to TSplus ports (default 443, 80, or custom) from unknown sources.
  • Responses containing a JSON array of email-like usernames (e.g., ["user@domain.com"]).

• Host IOCs:

  • hb.exe process running on the TSplus server.
  • Unauthorized access attempts logged in TSplus audit logs.

• Log Entries:

  • TSplus access logs showing requests to session enumeration endpoints without prior authentication.

Detection Engineering

YARA Rule

rule CVE_2025_26318_TSplus_Session_Enumeration {
    meta:
        description = "Detects network traffic or logs indicating exploitation of CVE-2025-26318"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26318"
    strings:
        $s1 = "/api/sessions" ascii wide nocase
        $s2 = "/hb/sessions" ascii wide nocase
        $s3 = "GET_SESSIONS" ascii wide nocase
        $s4 = "connected to the application" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-26318 - TSplus Session Enumeration Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to enumerate active sessions on TSplus Remote Access servers.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26318
logsource:
    category: webserver
    product: tsplus
detection:
    selection:
        cs-uri-query|contains:
            - '/api/sessions'
            - '/hb/sessions'
            - 'GET_SESSIONS'
    condition: selection
falsepositives:
    - Legitimate administrative tools (if authenticated)
level: medium

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-26318 - TSplus Session Enumeration Attempt"; flow:to_server,established; content:"/api/sessions"; http_uri; nocase; sid:1000001; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-26318 - TSplus Session Enumeration Attempt"; flow:to_server,established; content:"/hb/sessions"; http_uri; nocase; sid:1000002; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-26318 - TSplus Session Enumeration Attempt"; flow:to_server,established; content:"GET_SESSIONS"; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TSplus Remote Access to version 17.30 2024-10-30 or later. This is the only confirmed fix.
2. Restrict Network Access: Use firewall rules to limit access to the TSplus server to only trusted IPs or VPN users.
3. Enable Authentication: Ensure that all TSplus services require authentication before exposing session data.

Long-Term Measures:

• Implement network segmentation to isolate remote access servers.
• Enable detailed logging and monitoring for TSplus services.
• Conduct regular vulnerability scans and patch management.
• Consider using a Web Application Firewall (WAF) to block suspicious requests.

Workaround (if patching is not immediately possible):

• Disable the hb.exe service if not required, or block access to its network port at the firewall level.

Valters IT