PT-2019-15243 · Thinvnc · Thinvnc

Published 2019-10-16 · Updated 2020-08-24 · CVE-2019-17662

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinVNC version 1.0b1

Description The issue allows for arbitrary file read, which can compromise the VNC server, even when authentication is enabled. The password for authentication is stored in cleartext in a file, and this file can be accessed through a directory traversal attack using the ../../ThinVnc.ini path.

Recommendations For ThinVNC version 1.0b1, as a temporary workaround, consider restricting access to the ThinVnc.ini file to minimize the risk of exploitation. Avoid using the cleartext password storage mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Path traversal

Weakness Enumeration

CWE-522

CWE-22

Related Identifiers

CVE-2019-17662

Affected Products

Thinvnc

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/thinvnc_traversal.rb · Exploit
• 🔥 https://github.com/MuirlandOracle/CVE-2019-17662 · Exploit
• 🔥 https://github.com/shashankmangal2/Exploits/blob/master/ThinVNC-RemoteAccess/POC.py · Exploit
• 🔥 https://redteamzone.com/ThinVNC · Exploit
• 🔥 http://packetstormsecurity.com/files/154896/ThinVNC-1.0b1-Authentication-Bypass.html · Exploit
• 🔥 https://exploit-db.com/exploits/47519 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17662 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17662 · Vendor Advisory
• https://github.com/bewest/thinvnc/issues/5 · Note