![]() ![]() We launched CyberGhost’s bug bounty program in 2022 to build on our existing commitment to transparency and to work with the privacy and security community and with our customers to make our service even more secure. We’d like to highlight that the blog post published by PenTestPartners is not representative of CyberGhost’s operating procedures, nor our general experience with BugCrowd. Update: CyberGhost provided RestorePrivacy with a verbose comment, below: RestorePrivacy has reached out to CyberGhost VPN for a comment on the above but has not heard back by the time of publication. ![]() This process can lead to wasted time and put millions of users at risk of malicious exploitation. ![]() Unfortunately, it’s concerning that a security researcher must use external platforms to submit a crucial security report. Kape Technologies owns various top digital security and privacy products, such as ExpressVPN, CyberGhost, Private Internet Access, ZenMate, and Intego. The researcher reports that the experience following this avenue was cumbersome and time-wasting, and his initiative to share technical details over email with Kape resulted in Bugcrowd penalizing him for demonstrating unprofessional behavior and violating their Code of Conduct for making “Out of Band Contact” with the software vendor.Īfter several additional rounds of communication with both Kape and Bugcrowd, the platform deducted the “code of conduct point” allotted previously as a penalty and apologized. The flaw was reported to CyberGhost VPN upon discovery on January 3, 2023, and a response by the product owner, Kape Technologies, urged the researcher to submit the report to the firm’s Bugcrowd platform, where it runs a bug bounty and vulnerability disclosure program. Pen Test Partners Negative Disclosure Experience By exploiting this oversight, the researchers could craft a payload that embeds a malicious command in the ServerIp field. ![]() The point of failure lies in the developers overlooking some nuances of the CommandLineToArgvW API while constructing the command line string argument. NET type creation, it is still possible to exploit the vulnerability by cleverly crafting the payload and manipulating command line arguments, leading to successfully bypassing existing protections. The “ Pen Test Partners” researchers explain that despite CyberGhost’s developers implementing various protections, such as ensuring the named pipe isn’t accessible over the network and correctly configuring JsonSerializer to prevent arbitrary. The CyberGhost VPN client vulnerability (CVE-2023-30237) is an elevation of privilege issue that allowed attackers to inject malicious command lines using a crafted JSON payload.īy exploiting the RPC service, which was intended to only accept requests from the same process, attackers could bypass the process origin check, manipulate the communication protocol, and gain complete system control through OpenVPN’s plugin feature. Users of the popular VPN software are recommended to upgrade to client version 8.5 or later, released on February 24, 2023, to address the problem. The Windows client of CyberGhost VPN older than version 8.5 is vulnerable to a flaw that could allow attackers to perform command line injection and escalate their privileges on the impacted system.Īccording to a report by the security researcher who discovered the flaw, a specially crafted JSON payload sent to the CyberGhost RPC service during the launch of the OpenVPN process can lead to complete system compromise. ![]()
0 Comments
Leave a Reply. |