LiquidVPN Client up to 1.37 XPC Service tun_path/tap_path os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in LiquidVPN Client up to 1.37. This impacts an unknown function of the component XPC Service. The manipulation of the argument tun_path/tap_path leads to os command injection. This vulnerability is uniquely identified as CVE-2018-18858. Local access is required to approach this attack. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as critical, has been found in LiquidVPN Client up to 1.37. This issue affects an unknown functionality of the component XPC Service. The manipulation of the argument tun_path/tap_path with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "tun_path" or "tap_path" pathname within a shell command.

The bug was discovered 10/31/2018. The weakness was disclosed 11/20/2018 as EDB-ID 45782 as not defined exploit (Exploit-DB). The advisory is shared at exploit-db.com. The identification of this vulnerability is CVE-2018-18858 since 10/30/2018. An attack has to be approached locally. The successful exploitation needs a simple authentication. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1202 for this issue.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 20 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45782). The entries VDB-127035, VDB-127036 and VDB-127038 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• LiquidVPN Client

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion