CVE-2019-16384

Vulnerability

Cybele Thinfinity VirtualUI version 2.5.17.2 (and possibly earlier) suffers from a path traversal vulnerability [1]. The web application fails to sanitize user-supplied path parameters, enabling retrieval of files outside the intended web root directory. This occurs when the attacker knows the exact file location and the application has sufficient permissions to read it. The vulnerable request uses ../ notation to traverse directories, as demonstrated in the proof of concept retrieving win.ini from the Windows host [1].

Exploitation

Exploitation requires knowledge of the target file path and that the application has read permissions for that location. An attacker with network access to the VirtualUI web interface can send a crafted HTTP request containing ../ sequences in the path parameter. No authentication or special user interaction is needed; the vulnerability is reachable directly via the web server. The proof of concept shows a request that retrieves win.ini by traversing from the web directory to the Windows system folder [1].

Impact

Successful exploitation allows an attacker to exfiltrate sensitive files from the Windows host that reside outside the web directory. This compromises confidentiality of application data, system configuration files (e.g., win.ini), and potentially other protected resources. The attacker gains read access to files they would not normally be able to retrieve via the web interface. No privilege escalation or remote code execution is described in the reference [1].

Mitigation

As of the publication date (2020-06-04), no official patch or fix has been disclosed by Cyblesoft [1]. Users should restrict network access to the VirtualUI application, apply principle of least privilege to the Windows host, and monitor for anomalous path traversal requests. If a fix becomes available, it should be applied promptly. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog as of this writing.