Blame
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 1 | # Introduction |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 2 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 3 | Commit [8795ccfd25](https://github.com/OpenVPN/openvpn-build/commit/8795ccfd251b8252122dec43e6327a74856d17db) to openvpn-build made the NSIS installer manage services using SimpleSC NSIS plugin. The new service management commands did not properly quote service paths which created a subtle medium-level vulnerability. The vulnarability can be exploited if two conditions are met: |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 4 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 5 | * The C:\ drive is writeable by limited user(s) |
| 6 | * OpenVPN was installed using official **OpenVPN 2.4** Windows installers |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 7 | |
| 8 | Users of such systems are urged to upgrade to openvpn-install-2.4.3-I602 or later as soon as possible. |
|||
| 9 | ||||
| 10 | Thanks to Jason Haar for finding and reporting this issue! The original Nessus report is available below. |
|||
| 11 | ||||
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 12 | # Original Nessus report |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 13 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 14 | ## Description |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 15 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 16 | The remote Windows host has at least one service installed that uses an |
| 17 | unquoted service path, which contains at least one whitespace. A local |
|||
| 18 | attacker can gain elevated privileges by inserting an executable file in |
|||
| 19 | the path of the affected service. |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 20 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 21 | Note that this is a generic test that will flag any application affected |
| 22 | by the described vulnerability. |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 23 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 24 | ## Solution |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 25 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 26 | Ensure that any services that contain a space in the path enclose the |
| 27 | path in quotes. |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 28 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 29 | ## See Also |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 30 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 31 | * http://www.nessus.org/u?84a4cc1c |
| 32 | * http://cwe.mitre.org/data/definitions/428.html |
|||
| 33 | * https://www.commonexploits.com/unquoted-service-paths/ |
|||
| 34 | * http://www.nessus.org/u?4aa6acbc |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 35 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 36 | ## Output |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 37 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 38 | Nessus found the following services with an untrusted path: |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 39 | |
| a3675e | Samuli Seppänen | 2025-02-27 10:31:23 | 40 | * OpenVPNServiceLegacy : C:\Program Files\OpenVPN\bin\openvpnserv.exe |
| 41 | * OpenVPNServiceInteractive : C:\Program Files\OpenVPN\bin\openvpnserv.exe |