CVE-2019-16385

Vulnerability

Cybele Thinfinity VirtualUI version 2.5.17.2 is vulnerable to HTTP response splitting via the mimetype parameter within a PDF viewer request. An attacker can inject carriage return line feed sequences (%0d%0a) into the mimetype parameter, causing the response to be split and allowing control over response headers and body. This is demonstrated by a request to example.pdf?mimetype= followed by the malicious payload [1].

Exploitation

An attacker must convince a victim user to load a crafted URL pointing to a PDF viewer endpoint and containing the mimetype parameter with embedded CRLF sequences. The user must be logged into the application and interact with the link (e.g., via phishing or a cross-site request). The injected CRLF allows the attacker to inject arbitrary headers and content, resulting in a reflected cross-site scripting attack. The server returns a 200 OK response with the attacker-controlled payload reflected in the Content-type header or subsequent response [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session under the same origin. This could lead to session hijacking, data theft, or further application compromise. The attack does not require authentication beyond the victim being logged in, and no special privileges are needed [1].

Mitigation

As of the publication of the advisory (June 2020), no patch or fixed version had been announced for Thinfinity VirtualUI. Users should monitor vendor updates for a patched release. In the absence of a fix, organizations should limit exposure by restricting access to the application and ensuring users do not follow untrusted links [1].