Privilege escalation in ProtonVPN - CVE-2018-10169
Published: May 8, 2018
Vulnerability identifier: #VU12443
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-10169
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: ProtonVPN
Affected software:
ProtonVPN
ProtonVPN
Detailed vulnerability description
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists in the "ProtonVPN Service" service due to establishing an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods and in the "Connect" method due to accepting a class instance argument. A local attacker can take control of the OpenVPN command line, specify a dynamic library plugin that should run for every new VPN connection and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the "ProtonVPN Service" service due to establishing an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods and in the "Connect" method due to accepting a class instance argument. A local attacker can take control of the OpenVPN command line, specify a dynamic library plugin that should run for every new VPN connection and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability may result in system compromise.
How to mitigate CVE-2018-10169
Install update from vendor's website.