PT-2022-17166 · Cybele · Thinfinity Vnc

Oscar Uribe · Published 2022-05-20 · Updated 2022-06-01 · CVE-2022-25227

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thinfinity VNC version 4.0.0.1

Description The issue allows an unprivileged remote attacker to obtain an ID that can be used to send websocket requests and achieve remote code execution (RCE) if they can trick a user into browsing a malicious site. This is due to a Cross-Origin Resource Sharing (CORS) vulnerability.

Recommendations For Thinfinity VNC version 4.0.0.1, as a temporary workaround, consider restricting access to the websocket endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2022-25227

Affected Products

Thinfinity Vnc

References · 6

• 🔥 https://fluidattacks.com/advisories/clapton · Exploit
• https://osv.dev/vulnerability/CVE-2022-25227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25227 · Security Note
• https://t.me/cvenotify/30531 · Telegram Post
• https://t.me/cibsecurity/43040 · Telegram Post
• https://t.me/cvenotify/30963 · Telegram Post