CVE-2023-32634
📋 TL;DR
An authentication bypass vulnerability in SoftEther VPN allows local attackers to perform man-in-the-middle attacks against the CiRpcServerThread functionality. This could enable unauthorized access to VPN services without proper authentication. Affects SoftEther VPN users running vulnerable versions.
💻 Affected Systems
- SoftEther VPN
📦 What is this software?
Vpn by Softether
Vpn by Softether
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains unauthorized access to VPN network, potentially compromising internal resources, intercepting traffic, or pivoting to other systems.
Likely Case
Local attacker bypasses authentication to access VPN services they shouldn't have access to, potentially exposing sensitive network traffic.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated segments with detection of anomalous authentication attempts.
🎯 Exploit Status
Requires local access to perform man-in-the-middle attack against the CiRpcServerThread functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.02 or later
Vendor Advisory: https://www.softether.org/9-about/News/904-SEVPN202301
Restart Required: Yes
Instructions:
1. Download latest version from SoftEther VPN website. 2. Stop VPN service. 3. Install update. 4. Restart VPN service.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local user access to VPN server systems to trusted administrators only.
Network Segmentation
allIsolate VPN server from other critical systems to limit potential lateral movement.
🧯 If You Can't Patch
- Implement strict access controls to limit who has local access to VPN servers
- Monitor for unusual authentication patterns and local privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check SoftEther VPN version via management console or command line: vpncmd /tools /cmd:VersionCheck Version:
vpncmd /tools /cmd:VersionVerify Fix Applied:
Verify version is 5.02 or later using same command and ensure no authentication bypass occurs in testing.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful access
- Unusual local user activity on VPN server
Network Indicators:
- Unexpected RPC traffic patterns
- Authentication bypass patterns in network traffic
SIEM Query:
source="softether-vpn" AND (event_type="auth_failure" OR event_type="auth_success") | stats count by user, src_ip🔗 References
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755
- https://www.softether.org/9-about/News/904-SEVPN202301
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755
- https://www.softether.org/9-about/News/904-SEVPN202301
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1755
