PT-2018-10024 · Cyberghost+1 · Cyberghost+1

Fabius Watson + 1 · Published 2018-05-02 · Updated 2019-10-03 · CVE-2018-10646

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberGhost version 6.5.0.3180

Description The issue concerns a privilege escalation through the "CG6Service" service, which sets up a NetNamedPipe endpoint. This allows any installed application to connect and invoke publicly exposed methods. Specifically, the "ConnectToVpnServer" method is vulnerable as it accepts a connectionParams argument, giving an attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to run for every new VPN connection attempt, executing code in the context of the SYSTEM user.

Recommendations For CyberGhost version 6.5.0.3180, as a temporary workaround, consider disabling the "CG6Service" service until a patch is available. Restrict access to the "ConnectToVpnServer" method to minimize the risk of exploitation. Avoid using the connectionParams argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-10646

Affected Products

Cyberghost

Openvpn

References · 3

• https://osv.dev/vulnerability/CVE-2018-10646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10646 · Security Note
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-023.md · Note