Vulnerabilities in VPN Systems: Unauthenticated Attack Exploits

VPN systems (servers) are often exposed to the Internet and are a popular target for attacks due to their vulnerability. Recently, a vulnerability was discovered in Ivanti Connect Secure / Pulse Secure devices, which allows for remote takeover of a VPN server without authentication.

According to reports, a certain APT group, likely from China, gained access to over 1700 devices of this kind worldwide, including in Poland. Institutions from sectors such as government, military, telecommunications companies, defense suppliers, banking, finance and accounting, advisory firms, as well as aviation, airlines, and engineering have fallen victim to these attacks.

Rapid7 has published an analysis of the issue and identified two vulnerabilities. The first one is related to the fact that an API request on the device does not require authentication, providing access to any API function. The second vulnerability involves command injection in any API function, allowing for the execution of any system command with root privileges.

Despite the presence of two-factor authentication (2FA), the attack on the VPN server vulnerability bypasses this mechanism and enables the breaking of security measures. By gaining root access to the VPN server, the attacker has the same privileges as a logged-in VPN user.

This vulnerability is actively exploited as the initial entry point for further network exploitation. It is important to check if our VPN devices have been infected and take appropriate security measures, such as software updates and regular device scanning.

FAQ
1. What is VPN?
VPN (Virtual Private Network) is a technology that allows for a secure connection to a private network through the public Internet.

2. What is 2FA?
2FA (Two-Factor Authentication) is a method of securing access that requires the user to provide two different authentication factors, such as a password and a code generated on a device.

3. What is command injection?
Command injection is an attack technique that involves injecting malicious code into an application or system, which is then executed by the system as a command.

Source: sekurak.pl