Penetration Test Report (Cure53): pentest report mullvad v2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report Mullvad VPN Clients 09.2018
Cure53 & Assured AB, Dr.-Ing. M. Heiderich; J. Larsson; A. Alasjö; Dr. J. Magazinius, MSc.;
D. Weißer, BSc.; J. Hector, MSc.; N. Krein, BSc.; T.-C. “Filedescriptor” Hong
Index
Introduction
Scope
Identified Vulnerabilities
MUL-01-004 Windows: Privilege escalation by replacing executables (Critical)
MUL-01-006 Daemon: Any user can issue WebSocket commands (High)
Miscellaneous Issues
MUL-01-001 App: Missing BrowserWindow preferences allow RCE (Info)
MUL-01-002 App: WebSocket leaks real IP addresses and geolocation (Medium)
MUL-01-003 Daemon: Weak permissions on config and log files (Low)
MUL-01-005 OOS: CSRF on adding and removing forwarded ports (Low)
MUL-01-007 App: Lax version requirements for Node dependencies (Info)
Conclusions
Introduction
This report documents the results of a security assessment targeting the newly
developed Mullvad VPN client software. Carried out in September 2018, this project
comprised both a penetration test and a source code audit, benefitting from a
collaboration of two security teams. Specifically, two teams from the Assured AB in
Gothenburg, Sweden, and from the Cure53 in Berlin, Germany, were tasked with the
completion of this assessment.
The assessment took a total of eighteen days to complete and involved a total of eight
testers, three from the Assured AB and five from the Cure53 teams, respectively. Under
the white-box premise, the testers were granted access to latest binaries and the
relevant sources via GitHub. The methodological approach was a self-explanatory
choice because everything related to the tested Mullvad VPN scope is available in an
open source software format. In terms of the division of tasks, the Assured AB team
focused on investigating the Electron available for three operating systems. In
comparison, Cure53 audited the code for several components that fuel the Electron
application and glue the UIs to the OS-level interactions, communications and settings.
Cure53, Berlin · 09/20/18 1/9
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Throughout the project, all three involved parties, meaning the Mullvad, Assured AB and
Cure53 teams, communicated using a shared Slack channel, making the coordination of
the tests quite pleasant in general. All communications were quick, accurate and
productive. In addition to this, Cure53 further performed live-reporting for two issues
which were considered to carry greater risks. Mullvad commented on those and one
problem, namely the “Critical”-risk documented in MUL-01-004, has been fixed in
lightning speed while the tests were still ongoing, allowing for a successful fix verification
The other live-reported issue, namely MUL-01-006 was conversely communicated as an
expected behavior and flagged as such. The same was decided for MUL-01-002 after
discussing this report with the maintainers. However, the Mullvad team announced that a
discussion is ongoing to see if it is possible to add a better defense-in-depth mechanism
in the realm of this finding.
In sum, the assessment yielded a total of seven issues, which an exceptionally small
number given the complex field of the VPN software and the connected, vast attack
surface. It needs to be noted, however, that in this instance only applications and
supporting features were checked, meaning that no verdict can be made on the security
posture of the server-side and backend.
In the following sections, the report will first briefly detail the scope and then moves on to
a case-by-case analysis of findings, accompanying the technical backgrounds for the
aforementioned two vulnerabilities and five general weaknesses with the envisioned
mitigation approaches. In the final section, the Assured AB and Cure53 teams share
some broader conclusions about the tested Mullvad VPN scope. In light of the findings, a
summary pertaining to the security premise and properties of the Mullvad project is
offered.
Scope
• Mullvad VPN software for OSX, Linux and Windows
◦ https://github.com/mullvad/mullvadvpn-app
◦ Sources were made available to Cure53.
Cure53, Berlin · 09/20/18 2/9
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. MUL-01-001) for the purpose of facilitating any
future follow-up correspondence.
MUL-01-004 Windows: Privilege escalation by replacing executables (Critical)
It was discovered that the Windows installer allows to install the application anywhere on
the filesystem. If the application is installed in a location that is writeable by a regular
user (e.g. an external hard drive in order to keep the system drive as small as possible),
sensitive executables can be replaced. This, ultimately, can lead to a local privileges
escalation to SYSTEM, which means the most powerful privileges on the Windows
platform.
A central part of the application architecture is the mullvad-daemon service, which is
responsible for establishing the actual VPN connection through the use of openvpn.exe.
The openvpn.exe is supplied as part of the installation package and resides in the
installation’s location. Since the daemon service is running with SYSTEM privileges, any
binary executed by it will thus be running with SYSTEM as well. Simply replacing the
openvpn.exe with a malicious executable from the attacker allows to run any code with
the highest privileges.
For demonstration purposes, a simple binary was compiled and used as replacement for
the openvpn.exe. Listed below is the source of said executable. It is shown how it just
prints something to stdout and waits for user-input (allowing for the execution to be
observed in the task manager).
PoC executable source:
#include <stdio.h>
int main(int argc, char *argv[])
{
printf("Give LPE!");
getchar();
return 0;
}
Upon replacing the executables and starting the Mullvad application, one can observe
the execution of the malicious code using the task manager. Below is a screenshot
showing the process in the task manager, as well as the custom install location.
Cure53, Berlin · 09/20/18 3/9
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Fig.: PoC screenshot, showing executable running as SYSTEM
A first solution that may come to mind is to check binary signatures prior to execution,
however this approach is susceptible to time-of-check & time-of-use (TOC & TOU)
issues. In particular, the time in between the signature check and the actual execution of
the binary can potentially be abused to swap out the executables, meaning that the
execution of malicious code would remain possible. Hence, it is rather recommended to
ensure that all executables run by the daemon (or any other higher-privilege process)
are executed from a trusted location such as Program Files (only writeable by admins) of
the root drive.
Fix Note: This issue was live-reported and then fixed during the testing phase. Cure53
reviewed the fix and found the mitigation appropriate. The fix verification was successful.
MUL-01-006 Daemon: Any user can issue WebSocket commands (High)
It was noticed that Mullvad suffers from a general design flaw in which any user on a
system with Mullvad installed, can issue configurational changes to its runtime. This is
due to the fact that the Mullvad-daemon service opens a WebSocket interface to listen to
incoming commands and act accordingly.
Despite authentication being in place, the already reported weak fi