Full Report
We unveil zero-day vulnerabilities we discovered in virtual event platforms used in MSP/Fortune 500 communities, plus some insight on supply chain attacks.
Analysis Summary
# Vulnerability: Critical Flaws in Virtual Event Platforms (VFairs & Webcasts.com)
## CVE Details
* **CVE ID:** Not explicitly listed in the source (Zero-day vulnerabilities discovered by Huntress).
* **CVSS Score:** N/A (Highly Critical based on RCE and SQLi potential).
* **CWE:**
* CWE-89: SQL Injection
* CWE-79: Cross-Site Scripting (XSS)
* CWE-434: Unrestricted Upload of File with Dangerous Type
* CWE-639: Authorization Bypass Through User-Controlled Key (ID Toggling)
* CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
## Affected Systems
* **Products:**
* **VFairs** (Virtual event platform)
* **Webcasts.com** (Integrated with platforms like **6Connex**)
* **Versions:**
* VFairs: Version 3.33 and prior.
* Webcasts.com/6Connex: Specific version not listed (affected during February 2021 timeframe).
* **Configurations:** Default installations used for hosting virtual conferences and networking events.
## Vulnerability Description
Huntress researchers identified multiple high-impact flaws across popular virtual event platforms:
* **Broken Access Control/ID Toggling:** In both platforms, researchers could manipulate User/Attendee IDs to view or edit profiles belonging to other attendees. In Webcasts.com, this allowed for massive PII data dumps.
* **Arbitrary File Upload:** VFairs allowed users to upload files for profile pictures without strict validation. Researchers successfully uploaded PHP code, leading to Remote Code Execution (RCE).
* **SQL Injection:** VFairs was susceptible to time-based blind SQL injection, exposing the entire backend database.
* **Information Disclosure:** Publicly visible SQL database errors and unsecured API endpoints allowed unauthorized access to names, emails, IP addresses, job titles, and physical addresses.
## Exploitation
* **Status:** Discovered and reported by researchers; patched by vendors.
* **Complexity:** Low (Exploitation involved simple ID manipulation and standard web injection techniques).
* **Attack Vector:** Network (Remote via web browser).
## Impact
* **Confidentiality:** **High** (Massive leakage of PII/business contact data).
* **Integrity:** **High** (Ability to modify other users' profiles and inject malicious scripts).
* **Availability:** **High** (RCE and SQL injection could lead to full server compromise and service disruption).
## Remediation
### Patches
* **VFairs:** Upgrade to **Version 3.34** or later.
* **Webcasts.com / 6Connex:** The vendor applied server-side patches following the disclosure; ensure you are using the latest hosted version of the platform.
### Workarounds
* Limit the amount of PII shared during registration for virtual events.
* For event organizers: Review vendor security assessments and ensure "Private" settings are enabled for attendee lists where possible.
## Detection
* **Indicators of Compromise:** Unusual volume of profile update requests from a single IP, unexpected PHP files in image upload directories, and time-delayed responses in web logs (indicative of blind SQLi).
* **Detection Methods:** Web Application Firewalls (WAF) can be configured to block common SQLi and XSS patterns. Regular automated scanning of attendee-facing APIs for ID enumeration (IDOR) flaws.
## References
* [Huntress Blog - Zero-Day Vulnerabilities in Platforms](https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack)
* [6Connex Official Site](hXXps://www.6connex[.]com/)
* [VFairs Official Site](hXXps://www.vfairs[.]com/)