CVE-2023-31068
📋 TL;DR
This vulnerability in TSplus Remote Access allows attackers to modify theme directories with 'Everyone' Full Control permissions, potentially enabling arbitrary code execution. It affects TSplus Remote Access installations up to version 16.0.2.14 on Windows systems. Attackers could exploit this to gain unauthorized access or escalate privileges.
💻 Affected Systems
- TSplus Remote Access
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, leading to data theft, ransomware deployment, or complete control of affected systems.
Likely Case
Privilege escalation allowing attackers to execute malicious code with system-level permissions, potentially compromising the entire TSplus environment.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only allowing file modification without code execution.
🎯 Exploit Status
Exploitation requires initial access but then allows easy privilege escalation through directory manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.2.15 or later
Vendor Advisory: https://www.tsplus.net/support/security-advisories/
Restart Required: Yes
Instructions:
1. Download latest version from TSplus website. 2. Run installer as administrator. 3. Follow upgrade prompts. 4. Restart TSplus services.
🔧 Temporary Workarounds
Restrict Theme Directory Permissions
windowsManually adjust NTFS permissions to remove 'Everyone' Full Control from vulnerable directories.
icacls "%PROGRAMFILES(X86)%\TSplus\UserDesktop\themes" /remove Everyone /T
🧯 If You Can't Patch
- Apply strict access controls to TSplus directories, removing 'Everyone' permissions and limiting to authorized users only.
- Implement application whitelisting to prevent execution of unauthorized binaries from theme directories.
🔍 How to Verify
Check if Vulnerable:
Check permissions on %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes\* directories using 'icacls' command and look for 'Everyone:(F)' entries.Check Version:
Check TSplus Admin Tool → About or examine registry at HKEY_LOCAL_MACHINE\SOFTWARE\TSplus\VersionVerify Fix Applied:
Verify 'Everyone' group no longer has Full Control permissions on theme directories and TSplus version is 16.0.2.15 or higher.📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (file system access) showing unauthorized access to theme directories
- TSplus application logs showing unexpected theme modifications
Network Indicators:
- Unusual RDP connections to TSplus servers
- Unexpected file transfers to/from TSplus servers
SIEM Query:
source="windows" EventID=4663 AND ObjectName="*TSplus*UserDesktop*themes*" AND AccessMask="0x1F01FF"