CVE-2022-4967
📋 TL;DR
CVE-2022-4967 is an authorization bypass vulnerability in strongSwan VPN software where clients can authenticate with trusted certificates but claim arbitrary identities, bypassing identity-based access controls. This affects strongSwan versions 5.9.2 through 5.9.5 when using TLS-based EAP methods with certificate authentication. Organizations using strongSwan for VPN access with identity-based policies are vulnerable.
💻 Affected Systems
- strongSwan
📦 What is this software?
Strongswan by Strongswan
⚠️ Risk & Real-World Impact
Worst Case
Attackers with any trusted certificate can gain unauthorized VPN access, bypass network segmentation, access restricted resources, and potentially pivot to internal systems.
Likely Case
Unauthorized users gain VPN access with privileges of claimed identity, potentially accessing resources they shouldn't have permission to access.
If Mitigated
With proper network segmentation and additional authentication layers, impact is limited to initial access point only.
🎯 Exploit Status
Exploitation requires a trusted certificate and knowledge of target identity format. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.6 and later
Vendor Advisory: https://www.strongswan.org/blog/2024/05/13/strongswan-vulnerability-(cve-2022-4967).html
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update strongSwan to version 5.9.6 or later using package manager (apt-get upgrade strongswan, yum update strongswan, etc.). 3. Restart strongSwan service (systemctl restart strongswan). 4. Verify version with 'ipsec --version'.
🔧 Temporary Workarounds
Disable TLS-based EAP methods
linuxTemporarily disable vulnerable EAP methods until patching is complete
# Edit /etc/strongswan.conf or relevant config file
# Comment out or remove eap-tls, eap-ttls, eap-peap from authby settings
Enforce identity validation via alternative methods
linuxUse alternative authentication methods that properly validate identity
# Configure authby=pubkey or authby=secret instead of certificate-based EAP
🧯 If You Can't Patch
- Implement network segmentation to limit VPN access to minimal necessary resources
- Add multi-factor authentication or additional authorization checks for VPN connections
🔍 How to Verify
Check if Vulnerable:
Check strongSwan version with 'ipsec --version'. If version is between 5.9.2 and 5.9.5 inclusive, and TLS-based EAP methods are configured, system is vulnerable.Check Version:
ipsec --version | grep -o 'strongSwan [0-9.]*'Verify Fix Applied:
Run 'ipsec --version' to confirm version is 5.9.6 or later. Test VPN connections with various identities to ensure proper validation.📡 Detection & Monitoring
Log Indicators:
- Successful authentication with mismatched certificate subject and IKE/EAP identity
- Multiple authentication attempts with same certificate but different identities
Network Indicators:
- VPN connections from unexpected IP addresses with valid certificates
- Unusual access patterns following VPN authentication
SIEM Query:
source="strongswan" AND ("EAP identity mismatch" OR "certificate validation failed" OR "authentication succeeded" AND "identity")🔗 References
- https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136
- https://security.netapp.com/advisory/ntap-20240614-0006/
- https://www.cve.org/CVERecord?id=CVE-2022-4967
- https://www.strongswan.org/blog/2024/05/13/strongswan-vulnerability-(cve-2022-4967).html
- https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136
- https://security.netapp.com/advisory/ntap-20240614-0006/
- https://www.cve.org/CVERecord?id=CVE-2022-4967
- https://www.strongswan.org/blog/2024/05/13/strongswan-vulnerability-(cve-2022-4967).html
