CVE-2017-20123
📋 TL;DR
This vulnerability in Viscosity VPN client allows attackers to execute arbitrary code by exploiting an untrusted search path issue in the DLL handler. Attackers can plant malicious DLLs in directories that Viscosity searches, leading to remote code execution. Users of Viscosity 1.6.7 and earlier versions are affected.
💻 Affected Systems
- Viscosity VPN Client
📦 What is this software?
Viscosity by Sparklabs
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges, data theft, and persistent backdoor installation.
Likely Case
Attacker gains user-level access to execute arbitrary code, potentially stealing VPN credentials and network traffic.
If Mitigated
Limited impact if proper application whitelisting and DLL search path restrictions are in place.
🎯 Exploit Status
Exploit requires user interaction or network access to place malicious DLL in search path. Public exploit code available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.8
Vendor Advisory: https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-6-8/
Restart Required: Yes
Instructions:
1. Download Viscosity 1.6.8 from official website. 2. Install over existing version. 3. Restart computer to ensure all components are updated.
🔧 Temporary Workarounds
Restrict DLL Search Path
windowsUse Windows Group Policy or application control to restrict DLL search paths for Viscosity.
Set-ProcessMitigation -Name viscosity.exe -Disable DynamicCode -Enable ForceRelocateImages
Remove Write Permissions
windowsRemove write permissions from directories in Viscosity's DLL search path that non-admin users can access.
icacls "C:\Program Files\Viscosity" /deny Users:(W)
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized DLLs
- Monitor for DLL planting in directories accessible to Viscosity process
🔍 How to Verify
Check if Vulnerable:
Check Viscosity version in Help > About menu. If version is 1.6.7 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Viscosity" get versionVerify Fix Applied:
Verify version shows 1.6.8 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected DLL loads from non-standard directories
- Viscosity process loading DLLs from user-writable locations
Network Indicators:
- Unusual network connections from Viscosity process
- SMB connections to unexpected shares
SIEM Query:
process_name="viscosity.exe" AND (file_path="*\Users\*\*.dll" OR file_path="*\Temp\*.dll")🔗 References
- http://seclists.org/fulldisclosure/2017/Feb/1
- https://github.com/kacperszurek/exploits/tree/master/Viscosity
- https://vuldb.com/?id.96639
- https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-6-8/
- http://seclists.org/fulldisclosure/2017/Feb/1
- https://github.com/kacperszurek/exploits/tree/master/Viscosity
- https://vuldb.com/?id.96639
- https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-6-8/
