# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.0.0
# Tested on: Windows
# CVE : CVE-2023-31069
With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single
sign-on web portal and remote desktop gateway that enables users to
remotely access the console session of their office PC.
It is possible to create a custom web portal login page which allows a
user to login without providing their credentials.
However, the credentials are stored in an insecure manner since they are
saved in cleartext, within the html login page.
This means that everyone with an access to the web login page, can
easely retrieve the credentials to access to the application by simply
looking at the html code page.
This is a code snippet extracted by the source code of the login page
(var user and var pass):
// --------------- Access Configuration ---------------
var user = "Admin"; // Login to use when
connecting to the remote server (leave "" to use the login typed in this
page)
var pass = "SuperSecretPassword"; // Password to use when
connecting to the remote server (leave "" to use the password typed in
this page)
var domain = ""; // Domain to use when
connecting to the remote server (leave "" to use the domain typed in
this page)
var server = "127.0.0.1"; // Server to connect to
(leave "" to use localhost and/or the server chosen in this page)
var port = ""; // Port to connect to
(leave "" to use localhost and/or the port of the server chosen in this
page)
var lang = "as_browser"; // Language to use
var serverhtml5 = "127.0.0.1"; // Server to connect to,
when using HTML5 client
var porthtml5 = "3389"; // Port to connect to,
when using HTML5 client
var cmdline = ""; // Optional text that will
be put in the server's clipboard once connected
// --------------- End of Access Configuration ---------------
