CVE-2023-7235

Executive Summary

CVE-2023-7235 is a vulnerability in the OpenVPN GUI installer for Windows. The flaw exists because the installer, when using a non-standard installation path, does not set proper access control restrictions on the installation directory. This allows a local attacker with write access to the system to replace OpenVPN binaries with malicious executables, leading to arbitrary code execution in the context of the user running OpenVPN. The vulnerability affects versions prior to 2.6.9. No public proof-of-concept or exploit code has been identified at this time.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs write access to the installation directory.
• User Interaction (UI): None (N) – No user interaction is required beyond the initial installation.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data theft.
• Integrity (I): High (H) – Binaries can be replaced with malicious ones.
• Availability (A): High (H) – The attacker can disrupt the service.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 7.8 (High)

The threat level is High due to the potential for privilege escalation and arbitrary code execution.

Deep Dive & Mechanics

The vulnerability lies in the OpenVPN GUI installer's handling of directory permissions. When a user selects a non-standard installation path (e.g., C:\CustomOpenVPN), the installer fails to apply restrictive access control lists (ACLs) to that directory. By default, Windows allows BUILTIN\Users to write to directories created by standard users, unless explicitly restricted.

An attacker who gains write access to the system (e.g., through a compromised user account or malware) can:

1. Navigate to the OpenVPN installation directory.
2. Replace legitimate binaries (e.g., openvpn.exe, openvpn-gui.exe) with malicious executables.
3. When a legitimate user or service launches OpenVPN, the malicious binary executes with the user's privileges.

This is a classic example of a DLL Hijacking or Binary Planting attack, but here the entire binary is replaced rather than a side-loaded DLL.

Vulnerable vs. Patched Code

The vulnerability is not in the OpenVPN source code itself, but in the installer's behavior. The fix in version 2.6.9 ensures that the installer sets proper ACLs on the installation directory, restricting write access to only Administrators and SYSTEM.

Vulnerable Installer Behavior (pre-2.6.9):

• The installer creates the directory with default permissions, allowing BUILTIN\Users to write.

Patched Installer Behavior (2.6.9+):

• The installer explicitly sets the directory ACL to deny write access to non-privileged users.

No code diff is available as this is a configuration change in the installer, not a source code patch.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with OpenVPN GUI installed in a non-standard path (e.g., D:\OpenVPN).
• Write access to the installation directory (e.g., through a low-privilege user account).

Steps:

1. Identify the OpenVPN installation path (e.g., via registry or file system).
2. Create a malicious executable (e.g., malicious.exe) that performs a desired action (e.g., spawn a reverse shell).
3. Rename the malicious executable to match a legitimate OpenVPN binary (e.g., openvpn-gui.exe).
4. Replace the original binary with the malicious one.
5. Wait for a user or service to launch OpenVPN, triggering the malicious code.

Example (PowerShell):

# Assuming OpenVPN is installed in D:\OpenVPN
$installPath = "D:\OpenVPN\bin"
$maliciousBinary = "C:\temp\malicious.exe"
$targetBinary = "$installPath\openvpn-gui.exe"

# Backup original (optional)
Copy-Item $targetBinary "$targetBinary.bak"

# Replace with malicious binary
Copy-Item $maliciousBinary $targetBinary -Force

Blue Team

Detection:

• Monitor file integrity in OpenVPN installation directories.
• Alert on unexpected file modifications or replacements.
• Use Sysmon to log file creation and modification events (Event ID 11).

Prevention:

• Ensure OpenVPN is installed in the default path (C:\Program Files\OpenVPN) which has proper ACLs.
• Apply Group Policy to restrict write access to non-standard installation directories.
• Use application whitelisting (e.g., AppLocker) to prevent unauthorized executables.

Hunting:

• Search for file modification events in OpenVPN directories.
• Look for processes launched from non-standard paths with OpenVPN binary names.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – replace with actual hashes if available)
  • malicious_openvpn-gui.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Paths:
  • D:\OpenVPN\bin\openvpn-gui.exe (or any non-standard path)
• Registry Keys:
  • HKLM\SOFTWARE\OpenVPN (installation path)
• Network Connections:
  • Outbound connections from openvpn-gui.exe to unknown IPs (if malicious binary is a reverse shell).

Detection Engineering

YARA Rule

rule CVE_2023_7235_OpenVPN_Binary_Replacement {
    meta:
        description = "Detects potential binary replacement in OpenVPN installation directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-7235"
    strings:
        $s1 = "openvpn-gui.exe" nocase
        $s2 = "openvpn.exe" nocase
        $s3 = "openvpnserv.exe" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        for any of ($s*) : ($ in (0..filesize))
}

Sigma Rule

title: OpenVPN Binary Replacement Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file creation or modification in non-standard OpenVPN installation paths
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7235
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains:
            - 'OpenVPN\bin\openvpn-gui.exe'
            - 'OpenVPN\bin\openvpn.exe'
            - 'OpenVPN\bin\openvpnserv.exe'
    condition: selection
falsepositives:
    - Legitimate updates or reinstallation
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2023-7235 - Potential OpenVPN Binary Download from Non-Standard Path";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"openvpn-gui.exe"; http_uri;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenVPN GUI installer to version 2.6.9 or later.
2. If upgrade is not possible, reinstall OpenVPN to the default path (C:\Program Files\OpenVPN).
3. Manually restrict permissions on the installation directory:
   • Remove BUILTIN\Users write access.
   • Ensure only Administrators and SYSTEM have write permissions.

Long-term Measures:

• Implement application whitelisting to prevent unauthorized binaries.
• Regularly audit file integrity in critical directories.
• Use Group Policy to enforce secure installation paths.

Patch Details: Upgrade to OpenVPN GUI installer version 2.6.9, which sets proper ACLs on the installation directory.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert