CVE-2020-24772
📋 TL;DR
This vulnerability allows attackers to force the Clash for Windows client to open malicious SMB shares via crafted URLs, triggering NTLM authentication that can be relayed for code execution or captured for hash cracking. It affects users of Dreamacro Clash for Windows version 0.11.4. Attackers can exploit this through malicious websites visited by vulnerable users.
💻 Affected Systems
- Dreamacro Clash for Windows
📦 What is this software?
Clash by Clash Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via NTLM relay attacks leading to remote code execution, domain privilege escalation, or credential theft enabling lateral movement.
Likely Case
Credential theft via NTLM hash capture leading to unauthorized access to network resources, or limited code execution if NTLM relay succeeds.
If Mitigated
No impact if proper network segmentation, SMB restrictions, and patched software are in place.
🎯 Exploit Status
Exploitation requires user to visit malicious website; tools like Responder can automate NTLM relay/capture.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.11.5 and later
Vendor Advisory: https://github.com/Dreamacro/clash/issues/910
Restart Required: Yes
Instructions:
1. Download latest version from official GitHub repository. 2. Uninstall old version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Disable SMB client via Windows Firewall
windowsBlock outbound SMB connections to prevent NTLM authentication to untrusted shares.
New-NetFirewallRule -DisplayName "Block SMB Outbound" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block
Disable WebRTC in browser
allPrevent malicious websites from triggering Clash via crafted URLs.
🧯 If You Can't Patch
- Disable or restrict Clash for Windows application execution via application control policies.
- Implement network segmentation to isolate SMB traffic and use SMB signing to prevent relay attacks.
🔍 How to Verify
Check if Vulnerable:
Check Clash for Windows version in application settings or About dialog; version 0.11.4 is vulnerable.Check Version:
Not applicable via command line; check through application GUI.Verify Fix Applied:
Confirm version is 0.11.5 or higher in application settings.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing SMB authentication attempts from Clash process
- Unexpected outbound SMB connections from user workstations
Network Indicators:
- Outbound SMB traffic (TCP/445) from workstations to untrusted IPs
- NTLM authentication requests from Clash user agents
SIEM Query:
source="windows" event_id=4624 logon_type=3 process_name="clash.exe" OR destination_port=445 src_ip=workstation_ip