TunnelBear for Windows | Security Research Advisory | VerSprite TunnelBear for Windows | Security Research Advisory | VerSprite

Home  |  Research  |  Resources  |  Advisories  |  TunnelBear for Windows

TunnelBear for Windows

Privilege Escalation







Product version

Vulnerability Details

TunnelBear for Windows suffers from a SYSTEM privilege escalation vulnerability through the TunnelBearMaintenanceservice. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The OpenVPNConnect method accepts a server list argument that provides attacker control of the OpenVpn command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.

Vendor response

The vendor has released an update

Disclosure timeline

04-17-2018 - Vendor disclosure via email
04-17-2018 - Vendor disclosure via email
04-17-2018 - Vendor notified via Facebook
04-18-2018 - Vendor response and follow up via Facebook
04-18-2018 - Vendor submits update and requests additional exploitation details
04-18-2018 - VerSprite verifies vulnerability unresolved and submits detailed exploitation documentation
04-19-2018 - Vendor response "Team reviewing documentation"
04-19-2018 - Vendor submits an update for testing and requests testing data
04-20-2018 - VerSprite verifies vulnerability resolution and submits testing data
04-23-2018 - Vendor response and followup
04-25-2018 - Vendor notified of the advisory release
04-25-2018 - Vendor follow up

Offensive Minded Security Exploit Development

We are an international squad of professionals working as one.