# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.0.0
# Tested on: Windows
# CVE : CVE-2023-31069

With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single 
sign-on web portal and remote desktop gateway that enables users to 
remotely access the console session of their office PC.
It is possible to create a custom web portal login page which allows a 
user to login without providing their credentials.
However, the credentials are stored in an insecure manner since they are 
saved in cleartext, within the html login page.
This means that everyone with an access to the web login page, can 
easely retrieve the credentials to access to the application by simply 
looking at the html code page.

This is a code snippet extracted by the source code of the login page 
(var user and var pass):

   // --------------- Access Configuration ---------------
   var user = "Admin";                         // Login to use when 
connecting to the remote server (leave "" to use the login typed in this 
page)
   var pass = "SuperSecretPassword";           // Password to use when 
connecting to the remote server (leave "" to use the password typed in 
this page)
   var domain = "";                            // Domain to use when 
connecting to the remote server (leave "" to use the domain typed in 
this page)
   var server = "127.0.0.1";                   // Server to connect to 
(leave "" to use localhost and/or the server chosen in this page)
   var port = "";                              // Port to connect to 
(leave "" to use localhost and/or the port of the server chosen in this 
page)
   var lang = "as_browser";                    // Language to use
   var serverhtml5 = "127.0.0.1";              // Server to connect to, 
when using HTML5 client
   var porthtml5 = "3389";                     // Port to connect to, 
when using HTML5 client
   var cmdline = "";                           // Optional text that will 
be put in the server's clipboard once connected
   // --------------- End of Access Configuration ---------------