bewest / thinvnc

ThinVNC is a pure HTML5 & AJAX Remote Desktop implementation. ThinVNC works on any HTML5-compliant web browser. Users can access a remote PC from any computer or mobile OS; no additional plugin or installation will be required on the client side.
http://sourceforge.net/projects/thinvnc/
GNU General Public License v3.0
29 stars 23 forks source link

Authentication Bypass and Arbitrary file read can compromise this VNC server #5

Open Nikhithx86 opened 5 years ago

Nikhithx86 commented 5 years ago

An authenticated attacker can compromise the VNC server even password protected. There's a bug in the web client which is vulnerable to directory traversal. Accessing the credentials could compromise the whole VNC server and gives an attacker the terminal access to the remote system.