PT-2018-1297 · Proton+1 · Protonvpn+1

Fabius Watson + 1 · Published 2018-03-23 · Updated 2019-10-03 · CVE-2018-10169

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ProtonVPN version 1.3.3

Description The issue is related to insufficient access control in the ProtonVPN service, which establishes a NetNamedPipe endpoint. This allows arbitrary installed applications to connect and call publicly exposed methods, such as the Connect method. The Connect method accepts a class instance argument, providing attacker control over the OpenVPN command line. An attacker can specify a dynamic library plugin to execute code in the context of the SYSTEM user. This could allow a remote attacker to execute arbitrary code with SYSTEM privileges using the OpenVPN command line.

Recommendations For ProtonVPN version 1.3.3, consider disabling the ProtonVPN Service until a patch is available to prevent potential exploitation. Restrict access to the NetNamedPipe endpoint to minimize the risk of arbitrary code execution. Avoid using the dynamic library plugin feature in the OpenVPN command line until the issue is resolved.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-264

Related Identifiers

BDU:2018-00793

CVE-2018-10169

Affected Products

Openvpn

Protonvpn

References · 4

• https://osv.dev/vulnerability/CVE-2018-10169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10169 · Security Note
• https://bdu.fstec.ru/vul/2018-00793 · Security Note
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-017.md · Note