[FD] Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 
v29.0.0.48 (Studio Coast Pty Ltd). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

vMix 29 ships a Windows-native .NET Framework application with a built-in Web 
Controller HTTP server on port 8088. The HTTP API endpoint GET 
/api/?Function=ScriptStartDynamic&Value=<VB.NET source> takes the Value 
parameter as VB.NET source code, compiles and executes it via 
VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with a 
6-item substring blocklist, but the compilation template injects Imports 
System.Diagnostics into the generated source before the user's code, so an 
attacker can call Process.Start directly without writing the blocked substring. 
Combined with the Web Controller's default blank password (which the official 
documentation states means no login will be required regardless of the access 
settings), the entire /api route is reachable without authentication, yielding 
unauthenticated RCE as the user running vMix64.exe (commonly administrator). 
Pre-research public CVE count for vMix: 0.

Impact: Arbitrary OS command execution as the vMix64.exe run identity (commonly 
administrator), plus arbitrary file read/write via the same blocklist bypass; 
no credentials required.

Advisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/