CVE-2021-44466
📋 TL;DR
CVE-2021-44466 is a local privilege escalation vulnerability in Bitmask Riseup VPN 0.21.6. When installed in a non-default directory, improper ACLs allow low-privileged users to replace the VPN executable with malicious code. When an administrator runs the compromised executable, the attacker gains administrator privileges.
💻 Affected Systems
- Bitmask Riseup VPN
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining administrator/root privileges, enabling installation of persistent malware, data theft, and lateral movement.
Likely Case
Local attacker escalates privileges to administrator level, gaining full control over the affected system.
If Mitigated
No privilege escalation possible if proper ACLs are set or software is installed in default location.
🎯 Exploit Status
Exploitation requires local access and ability to write to installation directory. Attack is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.21.7 and later
Vendor Advisory: https://0xacab.org/leap/bitmask-vpn/-/issues/10749
Restart Required: Yes
Instructions:
1. Download latest version from official Riseup VPN website. 2. Uninstall vulnerable version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Set Proper ACLs on Installation Directory
allManually set restrictive permissions on the VPN installation directory to prevent unauthorized writes.
Windows: icacls "C:\Path\To\RiseupVPN" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"
Linux: chmod 755 /path/to/riseupvpn && chown root:root /path/to/riseupvpn/*
Reinstall in Default Location
allUninstall from non-default directory and reinstall in default system location where proper ACLs are automatically set.
🧯 If You Can't Patch
- Remove Riseup VPN from all systems where it's installed in non-default directories
- Implement strict access controls and monitoring on systems with vulnerable installations
🔍 How to Verify
Check if Vulnerable:
Check if Riseup VPN version is 0.21.6 AND installed in non-default directory. Verify ACLs on installation directory allow write access to non-admin users.Check Version:
Windows: Check program files or registry. Linux: riseup-vpn --version or check package manager.Verify Fix Applied:
Confirm version is 0.21.7 or later AND installation directory has proper ACLs restricting write access to administrators only.📡 Detection & Monitoring
Log Indicators:
- Unexpected file modifications in Riseup VPN installation directory
- Process execution of Riseup VPN from non-standard locations
- Privilege escalation events following VPN execution
Network Indicators:
- Unusual outbound connections following VPN client execution
SIEM Query:
Process creation where parent process is RiseupVPN.exe AND child process has elevated privileges