PT-2014-8831 · Openvpn · Openvpn Access Server

Publicado 2014-11-26 · Atualizado 2018-10-09 · CVE-2014-9104

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 1.5.6 and earlier

Description The issue affects the XML-RPC API in the Desktop Client, allowing remote attackers to hijack administrator authentication. This can lead to various malicious actions, including disconnecting established VPN sessions, connecting to arbitrary VPN servers, creating VPN profiles, and executing arbitrary commands, all via crafted API requests.

Recommendations For OpenVPN Access Server versions 1.5.6 and earlier, update to a version later than 1.5.6 to resolve the issue. As a temporary workaround, consider restricting access to the XML-RPC API to minimize the risk of exploitation. Avoid using the API for critical operations until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-9104

Produtos afetados

Openvpn Access Server

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Jul/76 · Exploit
• 🔥 https://youtube.com/watch?v=qhgysgfvQh8 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt · Exploit
• http://openvpn.net/index.php/access-server/security-advisories.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9104 · Nota de Segurança
• http://securityfocus.com/archive/1/532795/100/0/threaded · Nota