CVE-2024-3661

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
References
Link Resource
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
https://bst.cisco.com/quickview/bug/CSCwk05814
https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://fortiguard.fortinet.com/psirt/FG-IR-24-170
https://issuetracker.google.com/issues/263721377
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://my.f5.com/manage/s/article/K000139553
https://news.ycombinator.com/item?id=40279632
https://news.ycombinator.com/item?id=40284111
https://security.paloaltonetworks.com/CVE-2024-3661
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661
https://tunnelvisionbug.com/
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.leviathansecurity.com/research/tunnelvision
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
https://bst.cisco.com/quickview/bug/CSCwk05814
https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://fortiguard.fortinet.com/psirt/FG-IR-24-170
https://issuetracker.google.com/issues/263721377
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://my.f5.com/manage/s/article/K000139553
https://news.ycombinator.com/item?id=40279632
https://news.ycombinator.com/item?id=40284111
https://security.paloaltonetworks.com/CVE-2024-3661
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661
https://tunnelvisionbug.com/
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.leviathansecurity.com/research/tunnelvision
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability
Configurations

No configuration.

History

21 Nov 2024, 09:30

Type Values Removed Values Added
References () https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ - () https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ -
References () https://bst.cisco.com/quickview/bug/CSCwk05814 - () https://bst.cisco.com/quickview/bug/CSCwk05814 -
References () https://datatracker.ietf.org/doc/html/rfc2131#section-7 - () https://datatracker.ietf.org/doc/html/rfc2131#section-7 -
References () https://datatracker.ietf.org/doc/html/rfc3442#section-7 - () https://datatracker.ietf.org/doc/html/rfc3442#section-7 -
References () https://fortiguard.fortinet.com/psirt/FG-IR-24-170 - () https://fortiguard.fortinet.com/psirt/FG-IR-24-170 -
References () https://issuetracker.google.com/issues/263721377 - () https://issuetracker.google.com/issues/263721377 -
References () https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ - () https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ -
References () https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic - () https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic -
References () https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision - () https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision -
References () https://my.f5.com/manage/s/article/K000139553 - () https://my.f5.com/manage/s/article/K000139553 -
References () https://news.ycombinator.com/item?id=40279632 - () https://news.ycombinator.com/item?id=40279632 -
References () https://news.ycombinator.com/item?id=40284111 - () https://news.ycombinator.com/item?id=40284111 -
References () https://security.paloaltonetworks.com/CVE-2024-3661 - () https://security.paloaltonetworks.com/CVE-2024-3661 -
References () https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 - () https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 -
References () https://tunnelvisionbug.com/ - () https://tunnelvisionbug.com/ -
References () https://www.agwa.name/blog/post/hardening_openvpn_for_def_con - () https://www.agwa.name/blog/post/hardening_openvpn_for_def_con -
References () https://www.leviathansecurity.com/research/tunnelvision - () https://www.leviathansecurity.com/research/tunnelvision -
References () https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ - () https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ -
References () https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 - () https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 -
References () https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability - () https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability -

01 Jul 2024, 15:15

Type Values Removed Values Added
References
  • () https://bst.cisco.com/quickview/bug/CSCwk05814 -
  • () https://fortiguard.fortinet.com/psirt/FG-IR-24-170 -
  • () https://my.f5.com/manage/s/article/K000139553 -
  • () https://security.paloaltonetworks.com/CVE-2024-3661 -
  • () https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 -
  • () https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 -

08 May 2024, 22:15

Type Values Removed Values Added
References
  • () https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ -

08 May 2024, 17:15

Type Values Removed Values Added
Summary (en) By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. (en) DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

07 May 2024, 19:15

Type Values Removed Values Added
References
  • () https://news.ycombinator.com/item?id=40284111 -
  • () https://www.agwa.name/blog/post/hardening_openvpn_for_def_con -

07 May 2024, 18:15

Type Values Removed Values Added
References
  • () https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ -
  • () https://issuetracker.google.com/issues/263721377 -
  • () https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ -
  • () https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic -
  • () https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision -
  • () https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability -
Summary
  • (es) Por diseño, el protocolo DHCP no autentica mensajes, incluida, por ejemplo, la opción de ruta estática sin clases (121). Un atacante con la capacidad de enviar mensajes DHCP puede manipular rutas para redirigir el tráfico VPN, lo que le permite leer, interrumpir o posiblemente modificar el tráfico de red que se esperaba que estuviera protegido por la VPN. Muchos, si no la mayoría, de los sistemas VPN basados en enrutamiento IP son susceptibles a este tipo de ataques.

07 May 2024, 06:15

Type Values Removed Values Added
References
  • () https://news.ycombinator.com/item?id=40279632 -

07 May 2024, 01:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8
v2 : unknown
v3 : 7.6
References
  • {'url': 'https://www.leviathansecurity.com/blog/tunnelvision', 'source': '9119a7d8-5eab-497f-8521-727c672e3725'}
  • () https://tunnelvisionbug.com/ -
  • () https://www.leviathansecurity.com/research/tunnelvision -

06 May 2024, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-06 19:15

Updated : 2024-11-21 09:30


NVD link : CVE-2024-3661

Mitre link : CVE-2024-3661

CVE.ORG link : CVE-2024-3661


JSON object : View

Products Affected

No product.

CWE
CWE-306

Missing Authentication for Critical Function

CWE-501

Trust Boundary Violation