Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The 
research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

vMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The 
HTTP API endpoint GET /api/?Function=ScriptStartDynamic&Value=<VB.NET source> takes the Value parameter as VB.NET 
source code, compiles and executes it via VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with 
a 6-item substring blocklist, but the compilation template injects Imports System.Diagnostics into the generated source 
before the user's code, so an attacker can call Process.Start directly without writing the blocked substring. Combined 
with the Web Controller's default blank password (which the official documentation states means no login will be 
required regardless of the access settings), the entire /api route is reachable without authentication, yielding 
unauthenticated RCE as the user running vMix64.exe (commonly administrator). Pre-research public CVE count for vMix: 0.

Impact: Arbitrary OS command execution as the vMix64.exe run identity (commonly administrator), plus arbitrary file 
read/write via the same blocklist bypass; no credentials required.

Advisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/