CVE-2021-35523 : Security Advisory and Response

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add an external script file that is executed as a privileged user.

Understanding CVE-2021-35523

This CVE identifies a vulnerability in Securepoint SSL VPN Client version 2.0.30 that allows a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows systems.

What is CVE-2021-35523?

The vulnerability in Securepoint SSL VPN Client v2 before 2.0.32 enables a non-privileged local user to manipulate the OpenVPN configuration, leading to the execution of malicious scripts as a privileged user.

The Impact of CVE-2021-35523

This vulnerability poses a significant risk as it allows an attacker with local access to the system to gain high privileges, potentially leading to unauthorized control over the system.

Technical Details of CVE-2021-35523

The technical details of CVE-2021-35523 include:

Vulnerability Description

The vulnerability arises from the insecure handling of configurations in Securepoint SSL VPN Client, enabling a local user to perform privilege escalation.

Affected Systems and Versions

Securepoint SSL VPN Client v2 version 2.0.30 on Windows is affected by this vulnerability.

Exploitation Mechanism

A non-privileged local user can modify the OpenVPN configuration to execute a malicious script as a privileged user.

Mitigation and Prevention

To address CVE-2021-35523, the following steps can be taken:

Immediate Steps to Take

Users should update Securepoint SSL VPN Client to version 2.0.32 or higher to mitigate the privilege escalation risk.

Long-Term Security Practices

Implement least privilege access controls, monitor system configurations, and educate users on secure practices to prevent similar vulnerabilities.

Patching and Updates

Regularly check for security updates and patches from Securepoint to ensure systems are protected against known vulnerabilities.