TSPlus 16.0.0.0 Insecure Credential Storage

`# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage  
# Date: 2023-08-09  
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia  
# Vendor Homepage: https://tsplus.net/  
# Version: Up to 16.0.0.0  
# Tested on: Windows  
# CVE : CVE-2023-31069  
  
With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single   
sign-on web portal and remote desktop gateway that enables users to   
remotely access the console session of their office PC.  
It is possible to create a custom web portal login page which allows a   
user to login without providing their credentials.  
However, the credentials are stored in an insecure manner since they are   
saved in cleartext, within the html login page.  
This means that everyone with an access to the web login page, can   
easely retrieve the credentials to access to the application by simply   
looking at the html code page.  
  
This is a code snippet extracted by the source code of the login page   
(var user and var pass):  
  
// --------------- Access Configuration ---------------  
var user = "Admin"; // Login to use when   
connecting to the remote server (leave "" to use the login typed in this   
page)  
var pass = "SuperSecretPassword"; // Password to use when   
connecting to the remote server (leave "" to use the password typed in   
this page)  
var domain = ""; // Domain to use when   
connecting to the remote server (leave "" to use the domain typed in   
this page)  
var server = "127.0.0.1"; // Server to connect to   
(leave "" to use localhost and/or the server chosen in this page)  
var port = ""; // Port to connect to   
(leave "" to use localhost and/or the port of the server chosen in this   
page)  
var lang = "as_browser"; // Language to use  
var serverhtml5 = "127.0.0.1"; // Server to connect to,   
when using HTML5 client  
var porthtml5 = "3389"; // Port to connect to,   
when using HTML5 client  
var cmdline = ""; // Optional text that will   
be put in the server's clipboard once connected  
// --------------- End of Access Configuration ---------------  
  
`