Vulnerabilities in NASA’s VPN

Immersive Labs discovered multiple vulnerabilities in NASA’s VPN (virtual private network). Also, Shell uses the same VPN.

Alex Seymour, an Immersive Labs researcher, discovered the vulnerabilities on October 7. These could allow attackers who had access to a computer escalate privileges. Thus, they could achieve anything: files, folders and network services previously unavailable.

His discovery comes just two months after the warnings of the National Security Agency (NSA) and National Security Council (NSC). Thus, they both alerted about state-sponsored attacks aiming to exploit vulnerabilities in VPNs. “Coming hot on the heels of the UK and US Government warnings about VPN vulnerabilities, this underlines that often the technology protecting enterprises needs to be managed as tightly as the people using it. People tend to think of their VPN as one of the more secure elements of their security posture, so it should be a bit of a wakeup call for the industry,” Alex Seymour said.

Aviatrix, the open source enterprise VPN supplier, released a patch, v2.4.10 for this issue, on November 4. So, Seymour said that users should install the patch as soon as possible.

Immersive Labs announced that Aviatrix had taken on board advice on how to resolve the issue. ”The changes made to resolve the issue were timely and well implemented. They have kept communication open throughout the disclosure process, remaining positive and showing that they take the security of their customers and product seriously.” 

Two troublesome lines

Seymour discovered that the last two lines of a script indicated two local web servers starting when at the launch of the VPN. Afterwards he mentioned that the security flaw affected the Linux, macOS and FreeBSD versions of Aviatrix’s client. They all use OpenVPN commands -up and -down flags to execute shell scripts when a VPN connection starts or stops.

NASA’s VPN vulnerabilities come just a few months ago, Doctor Web discovered a harmful banking trojan. This was disguised as the popular virtual private network, NordVPN. Win32.Bolik.2 hid alongside VPN downloads, from a website which is easily mistaken for the official NordVPN’s site.