PT-2018-10024 · Cyberghost+1 · Cyberghost+1

Fabius Watson + 1 · Publicado 2018-05-02 · Atualizado 2019-10-03 · CVE-2018-10646

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberGhost version 6.5.0.3180

Description The issue concerns a privilege escalation through the "CG6Service" service, which sets up a NetNamedPipe endpoint. This allows any installed application to connect and invoke publicly exposed methods. Specifically, the "ConnectToVpnServer" method is vulnerable as it accepts a connectionParams argument, giving an attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user.

Recommendations For CyberGhost version 6.5.0.3180, as a temporary workaround, consider disabling the "CG6Service" service until a patch is available. Restrict access to the "ConnectToVpnServer" method to minimize the risk of exploitation. Avoid using the connectionParams argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-10646

Produtos afetados

Cyberghost

Openvpn

Referências · 3

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-023.md · Nota
• https://osv.dev/vulnerability/CVE-2018-10646 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10646 · Nota de Segurança