Severe Code Execution Vulnerabilities Affect OpenVPN-Based Applications

guest · Nov 22, 2021

Severe Code Execution Vulnerabilities Affect OpenVPN-Based Applications
November 22, 2021
https://www.securityweek.com/severe-code-execution-vulnerabilities-affect-openvpn-based-applications

Security researchers at Claroty have raised the alarm for a series of severe code execution vulnerabilities affecting virtual private network (VPN) solutions relying on OpenVPN.
The company documented four security errors in products from HMS Industrial Networks, MB connect line, PerFact, and Siemens that allow attackers to achieve code execution by tricking potential victims into visiting a maliciously crafted web page.

During its analysis of OpenVPN-based solutions, Claroty discovered that vendors usually deploy OpenVPN as a service with SYSTEM privileges, which poses security risks, because any remote or local applications can control an OpenVPN instance to initiate or terminate a secured connection.
Click to expand...

An attacker looking to exploit this flaw would simply need to trick the victim into accessing a malicious website containing embedded JavaScript code designed to send a blind POST request locally, to inject commands in the VPN client back end. This is a classic Server-Side Request Forgery (SSRF) case, the company said.

“The attacker does not need to set up a dedicated OpenVPN server of their own because the up OpenVPN directive command is being executed before the connection to the OpenVPN server occurs,” Claroty said.
To achieve remote code execution, however, access to the attacker-controlled SMB server is needed [...]
Click to expand...

Claroty: All Roads Lead to OpenVPN: Pwning Industrial Remote Access Clients

Executive Summary

Team82 took an extensive look at VPN vendor applications that have OpenVPN running under the hood.

Claroty’s researchers discovered a new attack concept to target VPNs.

Team82’s research uncovered four vulnerabilities in popular industrial VPN solutions from vendors HMS Industrial Networks, Siemens, PerFact, and MB connect line.

The vulnerabilities expose users to remote and arbitrary code execution attacks, and also enable attackers to elevate privileges.

All four vendors have either provided a fix in an updated version of their respective products, or suggested mitigations.

Click to expand...

Log in or Sign up

Severe Code Execution Vulnerabilities Affect OpenVPN-Based Applications

guest Guest

Log in or Sign up

Severe Code Execution Vulnerabilities Affect OpenVPN-Based Applications

guest Guest

Useful Searches