CVE-2023-30328
📋 TL;DR
This vulnerability in Shimo VPN Client for macOS allows attackers to bypass authentication by reusing process IDs (PID re-use) in the helper tool. Attackers can gain unauthorized access to VPN functionality without valid credentials. This affects macOS users running Shimo VPN Client version 5.0.4.
💻 Affected Systems
- Shimo VPN Client
📦 What is this software?
Shimo by Mailbutler
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of VPN tunnel, allowing attackers to intercept, modify, or redirect all network traffic through the VPN, potentially leading to credential theft, data exfiltration, or lateral movement.
Likely Case
Unauthorized VPN access enabling attackers to bypass network security controls, access internal resources, or conduct man-in-the-middle attacks on VPN traffic.
If Mitigated
Limited impact if VPN is used only for specific applications with additional authentication layers and network segmentation.
🎯 Exploit Status
Exploit requires local access to the system but authentication bypass is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.5 or later
Vendor Advisory: https://mailbutler.io/security
Restart Required: Yes
Instructions:
1. Check current version in Shimo VPN Client settings. 2. Update to version 5.0.5 or later through the application's update mechanism or vendor website. 3. Restart the application and system.
🔧 Temporary Workarounds
Disable Shimo VPN Helper Tool
macOSTemporarily disable the vulnerable helper tool component
sudo launchctl unload /Library/LaunchDaemons/com.shimo.helper.plist
sudo rm /Library/PrivilegedHelperTools/com.shimo.helper
Remove Shimo VPN
macOSUninstall Shimo VPN Client completely
sudo /Applications/Shimo.app/Contents/Resources/uninstall.sh
sudo rm -rf /Applications/Shimo.app
🧯 If You Can't Patch
- Disconnect from VPN and use alternative secure VPN solution
- Implement network monitoring for unusual VPN connection patterns
🔍 How to Verify
Check if Vulnerable:
Check if Shimo VPN version is 5.0.4 and helper tool is running: ps aux | grep shimoCheck Version:
defaults read /Applications/Shimo.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify version is 5.0.5 or later in application settings and helper tool PID changes with each authentication attempt📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts from same PID
- VPN connections without proper authentication logs
- Helper tool process spawning unexpectedly
Network Indicators:
- VPN connections from unauthorized IPs
- Unusual traffic patterns through VPN tunnel
SIEM Query:
process_name="com.shimo.helper" AND event_type="authentication" AND result="success" AND pid_count > 1🔗 References
- https://github.com/rand0mIdas/randomideas/blob/main/ShimoVPN.md
- https://raw.githubusercontent.com/rand0mIdas/randomideas/main/ShimoVPN.md?token=GHSAT0AAAAAACA3WX4SPH2YYOCWGV6LLVSGZBIEKEQ
- https://github.com/rand0mIdas/randomideas/blob/main/ShimoVPN.md
- https://raw.githubusercontent.com/rand0mIdas/randomideas/main/ShimoVPN.md?token=GHSAT0AAAAAACA3WX4SPH2YYOCWGV6LLVSGZBIEKEQ
