MetaVersPloit

Vulnerability analysis of commercial metaverse-based virtual office platforms

Author

• Mentors: Jaegi Kim (lead), Kwangwoon Jeong (deputy)
• PL: Woowon Kang
• PM: Youngwoon Kim; members: Dooyoung Kim, Yongsik Kim, Heeseong Ahn, Junhee Cho, Yechan Jeon

Goal 🚀

Metaverse platforms are headed past today's mobile market: always-on, space-agnostic infrastructure for companies, civilians, and government. As that surface grows, the risk that matters is less physical and more security — stability can drop when trust assumptions fail.

This project started with startups shipping metaverse virtual-office products and continued into Facebook's Horizon after the Meta rename. The goal was to cut security debt early, while the category was still young.

We enumerated features and attack vectors that virtual-office platforms share, then analyzed them for common bugs. The work is meant to harden those platforms and reduce cyber impact on the people who use them as workplaces.

Introduction

What is a virtual office?

"Metaverse" covers many domains. Five properties show up often:

• Seamlessness — continuous work across metaverse and reality
• Presence — a sense of being there that approaches the physical world
• Interoperability — real-time information sharing and experience between the two
• Concurrence — different people, different experiences, without space/time limits
• Economy — economic flow inside the metaverse

Those properties all rest on real-time interaction between physical and virtual worlds.

A virtual office takes that interaction and adds office-specific tooling — another world that mirrors desks, meetings, and documents. Physical office work couples to the metaverse so teams can keep collaborating from anywhere and keep the business moving.

Meeting rooms, desks, documents, 1:1s: the company environment, remapped into a metaverse product.

Service statistics

We tabulated roughly four months of monthly visits, unique visitors, visits per unique, visit duration, pages per visit, and bounce rate for Gather, oVice, Kumospace, Spatial, and Horizon.

COVID-era remote work pushed virtual-office traffic up. Broader opinion that remote work can be more efficient kept attention on the category.

Project approach

Project point

Over about four months we worked the problem in layers. On the web side we mapped features, permissions, and the tech stack. Where something looked weak, we cross-checked the same capability in binary clients and looked for both stack-specific and shared-function bugs. That layered pass is how we found the issues.

Vulnerability analysis methodology

We used a fixed checklist against each target:

1. Function analysis by target
2. Technology stack analysis
3. Architecture and attack-vector mapping
4. Attack-vector selection

Enumerate features first. Platforms differ, but they also share capabilities — classify those, and match them to weak spots.

From web and binary analysis, build a tech-stack list, match it to the feature list, and draw an architecture per platform. Mark attack vectors on that architecture, then pick the ones to pursue.

Common functions across platforms

Across the five platforms we settled on thirteen shared functions. Internally we call the office floor a space. The list covers space clock-in/out, meeting-room clock-in/out, invites, create/update/delete of objects in a space or room, content sharing, chat (voice, video, text), access control, space CRUD, user roles, and external document sharing. We turned that into a per-platform checklist.

Technology stacks

We also enumerated stacks so we could draw architectures. Important pieces differ by web versus binary client; we grouped the core ones under front-end, back-end, and IPC.

Matching the thirteen functions to those stacks told us where to spend analysis time — higher weight first.

Architecture and attack vectors by platform

We built architectures from the stack and feature lists for:

• Kumospace (web)
• oVice (web)
• Gather (web / PC binary)
• Spatial (web / mobile / PC VR)
• Horizon Workrooms (web / mobile / VR)

Shared-function areas became hotspots; unique features became coldspots. Final vectors included:

• IPC — WebSocket traffic for avatars, maps, themes, and similar live content; WebRTC for voice and screen share — hooking plus client-side code audit
• Origin / third-party APIs — network handlers and language modules across web and binary clients; request/response review
• Oculus VR / Android APK — code audit, JNI, and third-party libraries via hooking
• In-space objects — language and feature logic for logic bugs and weak controls

Kumospace

oVice

Gather

Spatial

Horizon Workrooms

Common attack impact list

We listed impacts that matter specifically inside a virtual office and picked ten that tie tightly to the bugs we saw.

Eavesdropping on meetings or 1:1 traffic mid-path is louder in cyberspace than in a physical room — no walls, no commute required. Information exposure is already a hard problem for real companies; in a virtual office the data sits closer to the surface, so the blast radius grows.

DoS can freeze work for an entire "office" that has no hallway to walk down. Outsiders can reach spaces they should never enter, steal data, or force features meant only for employees. Those impacts are not theoretical for this product class.

When logic bugs open RCE in the client that hosts the office, the situation is as bad as a hole in a corporate internal network — except the "office" may not sit behind the same perimeter assumptions people still carry from physical campuses.

Conclusion

Across the BoB project we treated these platforms as production workplaces and looked for ways to harden them. We filed 31 vulnerabilities across five products, web and binary, using the methodology above.

Security misconfiguration and logic bugs dominated the shared-function hotspots. Those bugs chained into DoS and feature-bypass scenarios. API manipulation on origin and third-party APIs reached privilege escalation and data exposure. Weak client handling of WebSocket payloads enabled socket manipulation — including voice/video eavesdropping on in-space content.

Spaces and rooms are the virtual stand-ins for meeting rooms. Access control is supposed to keep outsiders out. Implementation mistakes let outsiders force entry, steal data, or wipe content. Unity, Photon, and WebRTC showed up often; missing authz and leaked sessions made mid-path theft and client-side abuse straightforward.

Objects — desks, whiteboards, screens, plants — share process memory with the user client. A weak object that can load external content produced XSS, which chained to privilege escalation, session theft, DoS via internal APIs, and on Windows/macOS clients even remote code execution. That is the critical end of the spectrum for people who treat these apps as their office.

We hit the project goals in the allotted time, shared mitigations and the analysis method, and hope the notes help anyone still digging into this expanding metaverse surface.