Local User Execution of Arbitrary Code via ELECTRON_RUN_AS_NODE Environment Variable
CVE-2023-7245

Currently unrated

Key Information:

Vendor
Openvpn
Status
Openvpn Connect
Vendor
CVE Published:
20 February 2024

Summary

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable

Affected Version(s)

OpenVPN Connect Windows 3.0 (Windows) <= 3.4.3

OpenVPN Connect Windows 3.0 (macOS) <= 3.4.7

References

https://openvpn.net/vpn-server-resources/openvpn-connect-...
release-notes
https://openvpn.net/vpn-server-resources/openvpn-connect-...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.