CVE-2024-37391
📋 TL;DR
This vulnerability in ProtonVPN for Windows allows improper neutralization of special elements used in an OS command (CWE-78), potentially enabling command injection. Attackers could exploit this to execute arbitrary commands with the privileges of the ProtonVPN process. Only Windows users running ProtonVPN versions before 3.2.10 are affected.
💻 Affected Systems
- ProtonVPN for Windows
📦 What is this software?
Protonvpn by Proton
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary command execution with the privileges of the ProtonVPN process, potentially leading to privilege escalation if the process runs with elevated rights.
Likely Case
Local attacker executes commands with user-level privileges to steal data, install malware, or pivot to other systems.
If Mitigated
No impact if proper input validation and path handling are implemented as in the fixed version.
🎯 Exploit Status
Exploitation requires manipulating the drive installer path during ProtonVPN installation/update, suggesting local access and specific timing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.10
Vendor Advisory: https://github.com/ProtonVPN/win-app/commit/2e4e25036842aaf48838c6a59f14671b86c20aa7
Restart Required: Yes
Instructions:
1. Open ProtonVPN application. 2. Go to Settings > General. 3. Click 'Check for updates' or enable automatic updates. 4. Install version 3.2.10 or later. 5. Restart the application.
🔧 Temporary Workarounds
Disable ProtonVPN Drive component
windowsPrevent exploitation by disabling the vulnerable Drive component if not needed.
Uninstall ProtonVPN Drive via Windows Control Panel > Programs and Features
Use alternative VPN client
windowsTemporarily switch to another VPN client until ProtonVPN is updated.
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable ProtonVPN versions
- Implement application whitelisting to prevent unauthorized process execution
🔍 How to Verify
Check if Vulnerable:
Check ProtonVPN version in Settings > General. If version is below 3.2.10, the system is vulnerable.Check Version:
wmic product where "name like 'ProtonVPN%'" get versionVerify Fix Applied:
Confirm ProtonVPN version is 3.2.10 or higher in Settings > General, and verify the Setup/setup.iss file uses proper path quoting.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from ProtonVPN executable
- Failed installation attempts with malformed paths
Network Indicators:
- Unexpected outbound connections from ProtonVPN process
SIEM Query:
Process Creation where (Image contains 'ProtonVPN' OR ParentImage contains 'ProtonVPN') AND CommandLine contains unusual characters or path manipulation patterns