cve/2022/CVE-2022-25166.md

CVE-2022-25166

Description

An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.

POC

Reference

• https://github.com/RhinoSecurityLabs/CVEs
• https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/H4cksploit/CVEs-master
• https://github.com/RhinoSecurityLabs/CVEs
• https://github.com/merlinepedra/RHINOECURITY-CVEs
• https://github.com/merlinepedra25/RHINOSECURITY-CVEs