Christina Pöpper

An issue was discovered in Avira Phantom VPN where the VPN client insecurely configures the operating system, sending all IP traffic to the VPN server's IP address in plaintext outside the VPN tunnel. This occurs even if the traffic is not generated by the VPN client, and simultaneously uses plaintext DNS to look up the VPN server's IP address. This allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel.

The issue concerns the insecure configuration of the operating system by the Clario VPN client, which results in traffic to the local network being sent in plaintext outside the VPN tunnel, even when the local network uses a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. The problem is related to the lack of protection for transmitted data.

The issue is related to the insecure configuration of the operating system by the Clario VPN client, which allows all IP traffic to the VPN server's IP address to be sent in plaintext outside the VPN tunnel. This can be exploited by an adversary to trick the victim into sending plaintext traffic to the VPN server's IP address, thereby deanonymizing the victim. The vulnerability is also referred to as the "ServerIP attack" for traffic to the real IP address of the VPN server.

Name of the Vulnerable Software and Affected Versions WireGuard client versão 0.5.3 Description O cliente WireGuard versão 0.5.3 no Windows possui uma configuração insegura do sistema operacional e do firewall. Essa configuração pode bloquear o tráfego para uma rede local usando endereços IP não RFC1918. Um invasor pode explorar isso para enganar um usuário a bloquear o tráfego IP para endereços IP e serviços específicos, mesmo enquanto a VPN está ativa. Essa falha pode resultar na interrupção do acesso aos recursos da rede. Recommendations Atualize para uma versão mais recente do cliente WireGuard que resolva o problema de configuração do firewall.