CVE-2020-27519 (published 2021-04-30T14:15Z)

Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/pritunl/pritunl-client-electron
commit_details: repo_url: https://github.com/pritunl/pritunl-client-electron
author: Zachary Huff
author_date: 2020-09-04 11:42:55-04:00
msg: Update profile write
repository: repo_url: https://github.com/pritunl/pritunl-client-electron
repo_name: pritunl/pritunl-client-electron
description: Pritunl OpenVPN client
repo_language: Go
owner: pritunl
file_changes: filename: profile.go
change_type: ModificationType.MODIFY
diff: @@ -237,6 +237,10 @@ func (p *Profile) write() (pth string, err error) {
 
 		if strings.Contains(trimLine, "script-security") ||
 			strings.HasPrefix(trimLine, "log ") ||
+			strings.HasPrefix(trimLine, "log-append ") ||
+			strings.HasPrefix(trimLine, "syslog ") ||
+			strings.HasPrefix(trimLine, "management ") ||
+			strings.HasPrefix(trimLine, "plugin ") ||
 			strings.HasPrefix(trimLine, "up ") ||
 			strings.HasPrefix(trimLine, "down ") ||
 			strings.HasPrefix(trimLine, "route-pre-down ") ||

programming_language: Go
repo_url: https://github.com/pritunl/pritunl-client-electron
commit_details: repo_url: https://github.com/pritunl/pritunl-client-electron
author: Zachary Huff
author_date: 2020-09-02 18:51:02-04:00
msg: Filter openvpn configuration data
repository: repo_url: https://github.com/pritunl/pritunl-client-electron
repo_name: pritunl/pritunl-client-electron
description: Pritunl OpenVPN client
repo_language: Go
owner: pritunl
file_changes: filename: profile.go
change_type: ModificationType.MODIFY
diff: @@ -214,8 +214,43 @@ func (p *Profile) write() (pth string, err error) {
 
 	pth = filepath.Join(rootDir, p.Id)
 
+	data := ""
+	for _, line := range strings.Split(p.Data, "\n") {
+		trimLine := strings.TrimSpace(line)
+		trimLine = strings.Trim(trimLine, "#")
+		trimLine = strings.Trim(trimLine, "-")
+		trimLine = strings.Trim(trimLine, "_")
+		trimLine = strings.Trim(trimLine, ":")
+		trimLine = strings.Trim(trimLine, ";")
+		trimLine = strings.Trim(trimLine, "*")
+		trimLine = strings.Trim(trimLine, "%")
+		trimLine = strings.Trim(trimLine, "$")
+		trimLine = strings.Trim(trimLine, "+")
+		trimLine = strings.Trim(trimLine, "=")
+		trimLine = strings.Trim(trimLine, "~")
+		trimLine = strings.Trim(trimLine, "(")
+		trimLine = strings.Trim(trimLine, ")")
+		trimLine = strings.Trim(trimLine, "[")
+		trimLine = strings.Trim(trimLine, "]")
+		trimLine = strings.Trim(trimLine, "{")
+		trimLine = strings.Trim(trimLine, "}")
+
+		if strings.Contains(trimLine, "script-security") ||
+			strings.HasPrefix(trimLine, "log ") ||
+			strings.HasPrefix(trimLine, "up ") ||
+			strings.HasPrefix(trimLine, "down ") ||
+			strings.HasPrefix(trimLine, "route-pre-down ") ||
+			strings.HasPrefix(trimLine, "tls-verify ") ||
+			strings.HasPrefix(trimLine, "ipchange ") ||
+			strings.HasPrefix(trimLine, "route-up ") {
+
+			continue
+		}
+		data += line + "\n"
+	}
+
 	_ = os.Remove(pth)
-	err = ioutil.WriteFile(pth, []byte(p.Data), os.FileMode(0600))
+	err = ioutil.WriteFile(pth, []byte(data), os.FileMode(0600))
 	if err != nil {
 		err = &WriteError{
 			errors.Wrap(err, "profile: Failed to write profile"),

programming_language: Go