Penetration Test Report (7ASecurity): pentest report amneziavpn

Test Targets:
Amnezia VPN Mobile apps
Amnezia VPN Desktop apps
Pentest Report
Client:
Amnezia VPN
7ASecurity Test Team:
● Abraham Aranguren, MSc.
● Daniel Ortiz, BSc.
● Jesus Arturo Espinoza Soto
● Miroslav Štampar, PhD.
● Tarunkant Gupta, BTech.
7ASecurity
Protect Your Site & Apps From Attackers
sales@7asecurity.com
Pentest Report
INDEX
Introduction 3
Scope 4
Identified Vulnerabilities 5
AVP-01-001 WP2: Linux/Mac root PrivEsc via insecure Permissions (Critical) 5
AVP-01-002 WP1: Possible Android/iOS Leaks via Missing Security Screen (Low) 8
AVP-01-003 WP1: Possible Phishing via StrandHogg 2.0 on Android (Medium) 11
AVP-01-004 WP1: VPN Config Access via Android & iOS Backups (Medium) 13
AVP-01-005 WP1: Config Access via incorrect Android Keystore Usage (Medium) 15
AVP-01-006 WP2: Linux VPN Config Access via Insecure Permissions (High) 16
AVP-01-010 WP2: Linux/Mac/Win DoS via Predictable Port Usage (Medium) 17
AVP-01-011 WP2: Linux/Mac/Win PrivEsc via IPC Design Flaw (Critical) 19
AVP-01-014 WP2: Linux/Mac/Win RCE as root via Malicious Share Link (Critical) 22
AVP-01-015 WP1: Config Access via missing iOS KeyChain usage (Medium) 25
AVP-01-016 WP1: Config Access via missing iOS Data Protection (Medium) 26
Hardening Recommendations 29
AVP-01-007 WP1: Android Application Hardening Recommendations (Low) 29
AVP-01-008 WP1: Missing Android root & iOS Jailbreak Detection (Info) 30
AVP-01-009 WP1: Android Binary Hardening Recommendations (Info) 31
AVP-01-012 WP1/2: Possible Theft of Credentials via Plaintext Storage (Low) 32
AVP-01-013 WP2: Possible Weaknesses via Insecure Function Usage (Low) 34
Conclusion 36
7ASecurity © 2022
2
Pentest Report
Introduction
“Your personal self-hosted VPN
Free service to create a personal VPN on your server. Helps to access blocked content
without revealing privacy even to VPN providers.”
From: https://en.amnezia.org/
This document outlines the results of a whitebox security review conducted against the
implementation of the Amnezia VPN clients. The project was solicited by the Amnezia
VPN maintainers, funded by the Open Technology Fund (OTF), and executed by
7ASecurity in June and July 2022. The audit team dedicated 26 working days to
complete this assignment. Please note that this is the first penetration test for the
platform. Consequently, identification of new security weaknesses was expected to be
easier during this assignment, as more vulnerabilities are identified and resolved after
each testing cycle.
During this iteration, the aim was to review the security posture of the multiple Amnezia
VPN clients. The goal was to review all items in scope as thoroughly as possible to
ensure Amnezia VPN users can be provided with the best possible security.
The methodology implemented was whitebox: The 7ASecurity team was supplied with
access to documentation, desktop and mobile app builds, source code, as well as a test
VPN server, which was deployed following the Amnezia VPN documentation as a
reference implementation. A team of 5 senior auditors executed all tasks required for this
engagement, including preparation, delivery, documentation of findings and
communications.
The project entailed an audit of the main Amnezia VPN clients: Windows, Linux, Mac OS
X, and Android, while the iOS application became available towards the end of this
assignment. The core goal in scope for this exercise was to verify if the Amnezia VPN
clients deliver on their promise to protect user data as well as network traffic, and
suggest how the solution might be improved in the future in order to become more
difficult to attack by malicious adversaries. This included testing all clients, through static
code analysis as well as at runtime, with a special focus on attack vectors that could put
Amnezia VPN users or their data at risk.
All necessary arrangements were in place by June 2022, to facilitate a straightforward
commencement for 7ASecurity. In order to enable effective collaboration, information to
coordinate the test was relayed through email as well as a shared Slack channel. The
Amnezia VPN team was helpful and responsive throughout the audit, even during
7ASecurity © 2022
3
Pentest Report
out-of-office hours and weekends.
The project was competently defined and organized, which facilitated the audit for the
test team. As a result, the testers did not have the need to frequently ask or wait for
answers, and hence, there were no notable blockers during this iteration. Overall, the
test went well and 7ASecurity provided regular updates regarding the audit status and its
interim findings during this exercise.
The findings of the security audit can be summarized as follows:
Identified Vulnerabilities Hardening Recommendations Total
11 5 16
Moving forward, the scope section elaborates on the items under review, and the
findings section documents the identified vulnerabilities followed by hardening
recommendations with lower exploitation potential. Each finding includes a technical
description, a proof-of-concept (PoC) and/or steps to reproduce if required, plus
mitigation or fix advice for follow-up actions by the development team.
Finally, the report culminates with a conclusion providing detailed commentary, analysis,
and guidance relating to the context, preparation, and general impressions gained
throughout this test, as well as a summary of the perceived security posture of the
Amnezia VPN clients.
Scope
The following list outlines the items in scope for this project:
WP1: Whitebox Tests against AmneziaVPN Mobile clients
● https://play.google.com/store/apps/details?id=org.amnezia.vpn
● https://github.com/amnezia-vpn/desktop-client/tree/master/client/android
● https://github.com/amnezia-vpn/desktop-client/tree/dev/client/ios
WP2: Whitebox Tests against AmneziaVPN Desktop clients
● https://github.com/amnezia-vpn/desktop-client
7ASecurity © 2022
4
Pentest Report
Identified Vulnerabilities
This area of the report enumerates findings that were deemed to exhibit greater risk
potential. Please note these are offered sequentially as they were uncovered, they are
not sorted by significance or impact. Each finding has a unique ID (i.e. AVP-01-001) for
ease of reference, and offers an estimated severity in brackets alongside the title.
AVP-01-001 WP2: Linux/Mac root PrivEsc via insecure Permissions (Critical)
Retest Notes: The Amnezia VPN Team resolved this issue1, and 7ASecurity verified that
the fix is valid.
It was found that the Linux and Mac clients are currently installed with insecure
permissions. Please note that the Windows client is not affected by this issue. This was
confirmed on the latest Amnezia VPN Linux (2.0.92) and Mac (2.0.103) releases at the
time of writing. Malicious users can leverage this weakness to gain root privileges by
simply modifying some of the Amnezia VPN files. These issues were confirmed as
follows:
Issue 1: Root PrivEsc in Linux Client
Command:
echo 'echo "stamparm ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers' >>
'/opt/AmneziaVPN/client/bin/update-resolv-conf.sh'
After the Client is connected to the VPN, the script update-resolv-conf.sh is automatically
being run by the service, and the attacker (stamparm) becomes a passwordless SUDO
user. This was confirmed by in another terminal successfully as follows:
Command:
sudo whoami
Output:
root
1https://github.com/amnezia-vpn/desktop-client/pull/90
2https://github.com/amnezia-vpn/desktop-client/releases/tag/2.0.9
3https://github.com/amnezia-vpn/desktop-client/releases/tag/2.0.10
7ASecurity © 2022
5
Pentest Report
The root cause of this issue is that while the owner of the Linux VPN client is root, many
of the files and directories allow arbitrary writes from limited users, which offers multiple
privilege escalation opportunities to attackers:
Command:
ls -la /opt/AmneziaVPN/
Output:
total 27176
drwxr-xr-x 5 root root 4096 lip 21 21:08 ./
drwxr-xr-x 20 root root 4096 lip 21 21:07 ../
-rwxrwxrwx 1 root root 162 lip 21 21:07 AmneziaVPN_build.desktop*
drwxrwxrwx 9 root root 4096 li