Man-in-the-Middle (MitM) attack in Fortinet, Inc products - CVE-2024-3661

Vulnerability identifier: #VU91755

CSH Severity: Medium

CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-3661

CWE-ID: CWE-300

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to way the VPN client handles routes advertised by the DHCP server. A remote attacker with access to the local network can route the victim's traffic to a malicious server instead of sending it via a secured channel. 

This vulnerability was dubbed "TunnelVision".

Fortinet FortiClient for Windows
FortiClient (macOS)
FortiClient (Linux)
HPE Aruba Networking Virtual Intranet Access (VIA) Windows Client
Red Hat OpenShift Container Platform
IBM Qradar SIEM
HPE Aruba Networking Virtual Intranet Access (VIA) macOS Client
HPE Aruba Networking Virtual Intranet Access (VIA) Linux Client
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
NetworkManager (Red Hat package)
NetworkManager-dispatcher-routing-rules
NetworkManager-initscripts-updown
NetworkManager-config-server
NetworkManager-wwan
NetworkManager-wifi
NetworkManager-tui
NetworkManager-team
NetworkManager-ppp
NetworkManager-ovs
NetworkManager-libnm
NetworkManager-cloud-setup
NetworkManager-bluetooth
NetworkManager-adsl
NetworkManager
NetworkManager-libnm-devel
NetworkManager-initscripts-ifcfg-rh
NetworkManager-config-connectivity-anolis
OpenShift API for Data Protection (OADP)
HPE Aruba Networking Virtual Intranet Access (VIA) iOS Client

Install updates from vendor's website.

IBM Qradar SIEM - update to 7.5.0 Update Pack 11 IF02
OpenShift API for Data Protection (OADP) - update to 1.4.2
NetworkManager (Red Hat package) - addressed in versions 1.40.16-18.el8_10, 1.46.0-34.el9_4, 1.48.10-5.el9_5
NetworkManager-dispatcher-routing-rules - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-initscripts-updown - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-config-server - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-wwan - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-wifi - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-tui - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-team - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-ppp - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-ovs - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-libnm - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-cloud-setup - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-bluetooth - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-adsl - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-libnm-devel - addressed in versions 1.40.16-18.0.1, 1.44.2-4
NetworkManager-initscripts-ifcfg-rh - update to 1.44.2-4
NetworkManager-config-connectivity-anolis - update to 1.44.2-4
HPE Aruba Networking Virtual Intranet Access (VIA) iOS Client - update to 4.7.2
HPE Aruba Networking Virtual Intranet Access (VIA) macOS Client - update to 4.7.2
HPE Aruba Networking Virtual Intranet Access (VIA) Linux Client - update to 4.7.2
HPE Aruba Networking Virtual Intranet Access (VIA) Windows Client - update to 4.7.2
Red Hat OpenShift Container Platform - update to 4.15.44

• https://datatracker.ietf.org/doc/html/rfc2131#section-7
• https://datatracker.ietf.org/doc/html/rfc3442#section-7
• https://tunnelvisionbug.com/
• https://www.leviathansecurity.com/research/tunnelvision
• https://news.ycombinator.com/item?id=40279632
• https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
• https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
• https://issuetracker.google.com/issues/263721377
• https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
• https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability
• https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
• https://news.ycombinator.com/item?id=40284111
• https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
• https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
• https://www.fortiguard.com/psirt/FG-IR-24-170

• MitM attack in Fortinet FortiClient
• Red Hat Enterprise Linux 8 update for NetworkManager
• Red Hat Enterprise Linux update for NetworkManager
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in IBM QRadar SIEM
• Anolis OS update for NetworkManager
• TunnelVision vulnerability in HPE Aruba Networking Virtual Intranet Access clients
• Anolis OS update for NetworkManager
• Red Hat Enterprise Linux 9 update for NetworkManager