Incorrect Permissions in TSplus Remote Access Shared Login Scripts Enable Command Execution

Executive Summary

This vulnerability is due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files in the shared themes directory allow users without sufficient privileges to write to them. A local attacker with a valid session could modify these files to execute arbitrary commands when another user logs in using the same theme or operating mode.

Useful 0 Not Useful 0

Detection Guidance

Check for writable autostart1.tscr files in shared themes directories. Use commands like 'find / -name autostart1.tscr -type f -perm -o+w' to locate files with excessive permissions. Inspect file contents for unexpected modifications or commands.

Useful 0 Not Useful 0

Impact Analysis

Exploitation could allow lateral movement between users or privilege escalation depending on the affected user's privileges. An attacker could gain unauthorized access to sensitive data or systems by executing commands within another user's security context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user sessions or data, potentially violating GDPR's data protection principles or HIPAA's access control requirements. Exploitation may allow lateral movement or privilege escalation, compromising confidentiality and integrity of personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Remove write permissions from autostart1.tscr files in shared themes directories. Restrict access to the themes directory to authorized users only. Update TSplus Remote Access to the latest version if available.

Useful 0 Not Useful 0