Exploit Title: Thinfinity VirtualUI 2.5.41.0 – IFRAME Injection
\nDate: 16\/12\/2021
\nExploit Author: Daniel Morales
\nVendor: https:\/\/www.cybelesoft.com <https:\/\/www.cybelesoft.com\/>
\nSoftware Link: https:\/\/www.cybelesoft.com\/thinfinity\/virtualui\/ <https:\/\/www.cybelesoft.com\/thinfinity\/virtualui\/>
\nVersion: Thinfinity VirtualUI < v3.0
\nTested on: Microsoft Windows
\nCVE: CVE-2021-45092<\/p>\n
How it works
\nBy accessing the following payload (URL) an attacker could iframe any external website (of course, only external endpoints that allows being iframed).<\/p>\n
Payload
\nThe vulnerable vector is “https:\/\/example.com\/lab.html?vpath=\/\/wikipedia.com <https:\/\/example.com\/lab.html?vpath=\/\/wikipedia.com> ” where “vpath=\/\/” is the pointer to the external site to be iframed.<\/p>\n
Vulnerable versions
\nIt has been tested in VirtualUI version 2.1.37.2, 2.1.42.2, 2.5.0.0, 2.5.36.1, 2.5.36.2 and 2.5.41.0.<\/p>\n
References
\nhttps:\/\/github.com\/cybelesoft\/virtualui\/issues\/2 <https:\/\/github.com\/cybelesoft\/virtualui\/issues\/2>
\nhttps:\/\/www.tenable.com\/cve\/CVE-2021-45092 <https:\/\/www.tenable.com\/cve\/CVE-2021-45092>
\nhttps:\/\/twitter.com\/danielmofer <https:\/\/twitter.com\/danielmofer><\/p>\n","protected":false},"excerpt":{"rendered":"
Exploit Title: Thinfinity VirtualUI 2.5.41.0 – IFRAME Injection Date: 16\/12\/2021 Exploit Author: Daniel Morales Vendor: https:\/\/www.cybelesoft.com <https:\/\/www.cybelesoft.com\/> Software Link: https:\/\/www.cybelesoft.com\/thinfinity\/virtualui\/ <https:\/\/www.cybelesoft.com\/thinfinity\/virtualui\/> Version: Thinfinity VirtualUI < v3.0 Tested on: Microsoft Windows CVE: CVE-2021-45092 How it works By accessing the following payload (URL) an attacker could iframe any external website (of course, only external endpoints that allows …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-20943","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=20943"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20943\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=20943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=20943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=20943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}