OpenVPN Desktop client affected by a critical CSRF flaw

http://www.ehacking.net/2014/07/openvpn-desktop-client-affected-by.htmlResearchers at
SEC Consult have discovered a CSRF vulnerability in the OpenVPN Desktop
Client that can allow remote code execution.


Security researchers at SEC Consult have discovered a CSRF flaw in the OpenVPN Desktop client and promptly reported it to the company in May. OpenVPN Desktop
Client fo
r its Access Server is an SSL VPN for a variety of platforms.
The vulnerability only affects Windows versions of the application.

 

In response to the discovery, OpenVPN issued a security advisory to warn its customers of the presence of a Cross-Site Request Forgery (CSRF) vulnerability in its Desktop Client which could allow an attacker to execute arbitrary code remotely. 

“All Access Server
customers using the ‘Desktop Client’ app for Windows should upgrade
immediately to the OpenVPN Connect client.  The ‘Desktop Client’ is
obsolete and is no longer maintained or available for download. This
client contains a CSRF (Cross Site Request Forgery) vulnerability that
can allow remote code execution by a malicious web site,” 

“It is also bundled with an older
version of OpenSSL that has not received recent OpenSSL security
updates.  This advisory only applies to the OpenVPN Access Server
‘Desktop Client’ app for Windows, and does not affect OpenVPN Connect,
Private Tunnel, or community builds of OpenVPN for Windows.” OpenVPN
reported in the advisory.

Experts at SEC
Consult have verified that vulnerabilities affect OpenVPN Access Server
“Desktop Client” version 1.5.6, which was the most recent version at the
time of discovery. Also, any other versions of the product are affected
by the flaw.

OpenVPN is requesting its customers to update the Desktop Client to avoid attacks which exploit the CSRF flaw.
“Remote
attackers can execute arbitrary code and execute other attacks on
computers with the OpenVPN Access Server “Desktop Client” installed.
Affected users should upgrade immediately to the OpenVPN Connect
client.” the SEC Consult advisory states.

The attacker has to trick the user, running a vulnerable version of OpenVPN,  in to visit a malicious site.
“The
OpenVPN Access Server ‘Desktop Client’ consists of two parts, a Windows
service that offers an XML-RPC API via a webserver on localhost and a GUI component that connects to this API,” 
“The XML-RPC API is vulnerable to Cross-Site Request Forgery (CSRF). Using the API commands an attacker can: unmask a victim (e.g. by
disconnecting an established VPN connection), perform MITM attacks (by
connecting the victim to an ‘evil’ VPN server), execute arbitrary code
with SYSTEM privileges (by adding a VPN profile that executes code).”

SEC Consult has provided a video proof of concept for the OpenVPN Access Server ‘Desktop Client’ vulnerability.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Blind SQL Injection Tutorial to Hack a Website

In the previous article, we have the basics of SQL Injection; what SQLi is and what are the types of SQL injection. And, In...

What is SQL Injection? Tutorial: Type and Example

What is SQL injection, and what are the types of SQL injection? These are the common questions, and we will seek the answer to...

Are Cisco 300-410 Exam and Its Related Certification Your Pathway to Career Success? Find Out about This

Introduction Career success can mean different things to different people. For some, it could mean having a prestigious title and for others, it could be...

How to Hack Windows 10 Password Using FakeLogonScreen in Kali Linux

This article demonstrates an in-depth guide on how to hack Windows 10 Passwords using FakeLogonScreen. Hacking Windows 10 password is an exciting topic and...

LOOKING FOR HACKING RECIPES FORM THE PRO?

Then sign up for FREE to the ehacking’s exclusive group. You will get the exclusive tips/tricks, tutorials, webinars & courses that I ONLY share with my fellow on this exclusive newsletter.