PT-2014-8831 · Openvpn · Openvpn Access Server

Published 2014-11-26 · Updated 2018-10-09 · CVE-2014-9104

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 1.5.6 and earlier

Description The issue affects the XML-RPC API in the Desktop Client, allowing remote attackers to hijack administrator authentication. This can lead to various malicious actions, including disconnecting established VPN sessions, connecting to arbitrary VPN servers, creating VPN profiles, and executing arbitrary commands, all via crafted API requests.

Recommendations For OpenVPN Access Server versions 1.5.6 and earlier, update to a version later than 1.5.6 to resolve the issue. As a temporary workaround, consider restricting access to the XML-RPC API to minimize the risk of exploitation. Avoid using the API for critical operations until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-9104

Affected Products

Openvpn Access Server

References · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Jul/76 · Exploit
• 🔥 https://youtube.com/watch?v=qhgysgfvQh8 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-1_OpenVPN_Access_Server_Desktop_Client_Remote_Code_Execution_via_CSRF_v10.txt · Exploit
• http://openvpn.net/index.php/access-server/security-advisories.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9104 · Security Note
• http://securityfocus.com/archive/1/532795/100/0/threaded · Note