Expired VPN appliance exposes a known authentication bypass
- Affected asset
- vpn.example.com.au (203.0.113.42)
- Rating
- Extreme Likely 4 × Critical 6 = 24
Description
The remote access appliance is running firmware three major versions behind current and is affected by a published authentication bypass. An attacker on the internet can reach the internal network without valid credentials by sending a crafted request to the session endpoint.
Evidence
$ curl -sk https://203.0.113.42/dana-na/../dana/html5acc/guacamole/ \
-H "Host: vpn.example.com.au"
HTTP/1.1 200 OK
Server: MAG-VPN 9.1R2 (build 4711) # 9.1R18 is current
X-Session: created uid=0 sslvpn-admin
The response confirms an authenticated session was created for an administrative user without any credentials being supplied.
Impact
The appliance sits at the boundary of the internal network. A working bypass gives an attacker the same reach as a remote employee, and from there the internal network is in play. This is the single most valuable target on most perimeters, which is why it is tested first.
Remediation
Update the appliance to the current firmware, which closes the bypass, then rotate all local and administrative credentials because the device may already have been reached. Restrict the management interface to named administrative addresses, and enable multi-factor authentication on all remote access.