CVE-2022-25166

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

CVSS v3.1

5.0 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

1.44% chance of exploitation in the next 30 days, 71th percentile

Published

2022-04-14

Updated

2024-08-03

Proof-of-concept exploits (3)

• https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
• merlinepedra/RHINOECURITY-CVEs
• merlinepedra25/RHINOSECURITY-CVEs

References

• CVE Record
• NVD entry

Related

• CVE-2017-12149
• CVE-2017-5754
• CVE-2017-7504
• CVE-2017-7529
• CVE-2022-25165
• CVE-2022-25237