PT-2018-10023 · Golden Frog+1 · Vyprvpn+1

Fabius Watson + 1 · Published 2018-05-02 · Updated 2019-10-03 · CVE-2018-10645

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Golden Frog VyprVPN version 2.12.1.8015

Description The issue allows for SYSTEM privilege escalation through the "VyprVPN" service, which establishes a NetNamedPipe endpoint. This endpoint exposes methods that can be called by applications, including the SetProperty method. This method enables an attacker to configure the AdditionalOpenVpnParameters property, thereby controlling the OpenVPN command line. An attacker can use the OpenVPN plugin parameter to specify a dynamic library plugin that runs for every new VPN connection attempt, executing code in the context of the SYSTEM user. The attack can be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.

Recommendations For Golden Frog VyprVPN version 2.12.1.8015, as a temporary workaround, consider disabling the SetProperty method or restricting access to the "VyprVPN" service until a patch is available. Avoid using the AdditionalOpenVpnParameters property and the OpenVPN plugin parameter in the affected service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-10645

Affected Products

Openvpn

Vyprvpn

References · 3

• https://osv.dev/vulnerability/CVE-2018-10645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10645 · Security Note
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-025.md · Note