Securepoint SSL VPN Client 访问控制错误漏洞
漏洞ID | 2492109 | 漏洞类型 | 访问控制错误 |
发布时间 | 2021-06-30 | 更新时间 | 2021-07-05 |
CVE编号 | CVE-2021-35523 | CNNVD-ID | CNNVD-202106-1900 |
漏洞平台 | N/A | CVSS评分 | N/A |
|漏洞来源
|漏洞详情
Securepoint SSL VPN Client是开源的一个SSL VPN 客户端,适用于 Windows。 Securepoint SSL VPN Client v2 中存在访问控制错误漏洞,该漏洞源于未对软件的配置功能做安全处理。 攻击者可通过将本地权限升级到NT AUTHORITYSYSTEM,从而允许本地非特权用户可以修改“\\%APPDATA\\%Securepoint SSL VPN 下的OpenVPN配置,并添加一个以特权用户身份执行的外部脚本文件。以下产品及版本受到影响:Windows上2.0.32之前的Securepoint SSL VPN Client v2。
|漏洞EXP
Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30
Metadata
===================================================
Release Date: 29-Jun-2021
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product: Securepoint SSL VPN Client
Fixed in: version 2.0.32
Tested on: Windows 10 x64 fully patched
CVE: CVE-2021-35523
URL: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Vulnerability Status: Fixed with new release
Vulnerability Description (copied from the CVE Details)
===================================================
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.
A full vulnerability description is available here: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Suggested Solution
===================================================
End-users should update to the latest available version.
Disclosure Timeline
===================================================
14.04.2021: The vulnerability was discovered and reported to [email protected]
15.04.2021: The report was triaged
26.04.2021: Securepoint SSL VPN Client Version 2.0.32 was released, which contains an initial fix for the vulnerability
23.06.2021: Securepoint SSL VPN Client Version 2.0.34 was released, which contains additional security measures.
28.06.2021: CVE-2021-35523 was assigned: https://nvd.nist.gov/vuln/detail/CVE-2021-35523
29.06.2021: Responsible disclosure in cooperation with Securepoint: https://github.com/Securepoint/openvpn-client/security/advisories/GHSA-v8p8-4w8f-qh34
___________
Florian Bogner
Information Security Expert, Speaker
Bee IT Security Consulting GmbH
Nibelungenstraße 37
3123 A-Schweinern
Mail: [email protected]
Web: https://www.bee-itsecurity.at
|参考资料
来源:MISC
链接:https://github.com/Securepoint/openvpn-client/security/advisories/GHSA-v8p8-4w8f-qh34
来源:MISC
链接:https://bogner.sh/2021/04/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
本文由 华域联盟 原创撰写:华域联盟 » Securepoint SSL VPN Client 访问控制错误漏洞
转载请保留出处和原文链接:https://www.cnhackhy.com/98525.htm