CVE-2026-13379

Executive Summary

CVE-2026-13379 affects the OpenVPN Windows interactive service (versions 2.7_alpha1 through 2.7.4). A remote attacker can exploit a crafted search domain during the disconnection process to cause persistent DNS state pollution (e.g., poisoning the system’s DNS resolver cache) or a denial-of-service condition (service crash). The vulnerability arises from improper validation of the search domain parameter sent from the server to the client. No patch is currently available from the vendor, and no public exploit code has been released. The CVSS score is 0.0 as reported, indicating either unavailability or a reserved ID, but the impact is real and requires immediate attention for affected deployments.

CVSS Breakdown & Threat Level

Threat Level: High due to potential for persistent DNS poisoning and crash of the interactive service, leading to business disruption.

Deep Dive & Mechanics

The OpenVPN Windows interactive service (openvpnserv2.exe or similar) processes configuration parameters during connection/disconnection. The search domain list (dhcp-option DOMAIN or dhcp-option DOMAIN-SEARCH) is accepted from the server and applied to the client’s DNS resolver settings. In vulnerable versions, the service fails to sanitize the length or content of a search domain string during the disconnection phase (when the service cleans up DNS settings). By sending a malformed or excessively long search domain, an attacker can:

• Write arbitrary data to the system’s DNS configuration registry keys, causing persistent DNS state pollution (e.g., redirecting traffic to malicious DNS servers).
• Trigger a buffer overflow or null pointer dereference, leading to a crash of the interactive service (denial of service).

The attack is performed remotely by a malicious OpenVPN server or through man-in-the-middle on the control channel, since the client trusts the server’s configuration.

Vulnerable vs. Patched Code

Vulnerable (OpenVPN 2.7_alpha1 – 2.7.4): The openvpnserv module does not validate the search domain string length or content. During disconnection, the cleanup function iterates through stored search domains and applies them to the registry without bounds checking.

// Vulnerable example (pseudo)
void clean_dns_search_domains(DHCP_OPTIONS *opt) {
    for (int i = 0; i < opt->num_domains; i++) {
        // No length check on opt->domains[i] before writing to registry
        RegSetValueEx(hKey, L"SearchList", 0, REG_SZ, 
                      (BYTE*)opt->domains[i], wcslen(opt->domains[i]) * 2 + 2);
    }
}

Patched (expected – no official patch yet): A patch would include input validation and sanitization:

// Patched example
void clean_dns_search_domains(DHCP_OPTIONS *opt) {
    for (int i = 0; i < opt->num_domains; i++) {
        // Validate length and content
        if (wcslen(opt->domains[i]) > MAX_DOMAIN_LEN || 
            contains_forbidden_chars(opt->domains[i])) {
            LogWarning("Skipping malformed search domain");
            continue;
        }
        // Properly escape or truncate before registry write
        WCHAR safe[MAX_DOMAIN_LEN];
        sanitize_domain(opt->domains[i], safe, MAX_DOMAIN_LEN);
        RegSetValueEx(hKey, L"SearchList", 0, REG_SZ, 
                      (BYTE*)safe, wcslen(safe) * 2 + 2);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Attacker controls an OpenVPN server or can MITM the control channel.
• Target runs OpenVPN 2.7_alpha1–2.7.4 on Windows.
• Target connects to attacker’s server.

Attack Steps:

1. Set up a malicious OpenVPN server.
2. In server configuration, include a crafted dhcp-option DOMAIN-SEARCH <malicious> with a very long string (e.g., 10,000+ characters or special characters like null bytes).
3. Wait for the target client to connect (triggering DNS assignment).
4. Initiate disconnection (close VPN session). The interactive service processes the search domain cleanup.
5. Observe: either DNS registry corrupted (e.g., HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList contains garbage) or service crashes (Event ID 7031 from Service Control Manager).

Lab Setup:

• Use VirtualBox/VMware with Windows 10/11 target.
• Install OpenVPN 2.7.4 (vulnerable).
• Set up an OpenVPN server (Linux) with custom config:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
push "dhcp-option DOMAIN-SEARCH $(python3 -c 'print("A"*5000)')"

• Connect client to server, then disconnect from client side or server side.

Blue Team

Detection:

• Monitor Windows Event Logs for Service Control Manager events (7031 – service terminated unexpectedly).
• Monitor DNS registry changes (SearchList key) for unexpected long values.
• Use Sysmon to detect process crash of openvpnserv.exe (Event ID 13 – CreateRemoteThread for crash? Better: Event ID 3 – Network connection, but not directly helpful).
• Network IDS: Alert on OpenVPN control channel messages containing extremely long dhcp-option strings (over 1024 bytes).

Mitigation:

• Upgrade to patched version when available.
• Restrict which OpenVPN servers clients can trust (use TLS authentication and certificates).
• Implement registry ACLs to prevent unauthorized writes to DNS keys.
• Disable automatic search domain assignment via client configuration (dhcp-option DOMAIN-SEARCH can be blocked by client config: pull-filter ignore "dhcp-option").

Indicators of Compromise (IOCs)

• Event ID 7031 (Service terminated unexpectedly) for OpenVPNServiceInteractive.
• Registry key HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList containing unexpectedly long or malformed strings.
• Network traffic showing OpenVPN PUSH_REPLY or control channel messages with dhcp-option DOMAIN-SEARCH > 256 bytes.
• Process crash dump of openvpnserv.exe in %TEMP% or %SystemRoot%\Minidump.
• DNS resolution irregularities (domains resolving to unexpected IPs due to polluted search list).

Detection Engineering

YARA Rule

rule OpenVPN_DNS_SearchDomain_Exploit {
    meta:
        description = "Detects OpenVPN interactive service crash or malicious search domain in process memory"
        author = "Valters IT"
        date = "2026-01-27"
        cve = "CVE-2026-13379"
    strings:
        $crash_sig = "OpenVPNServiceInteractive"
        $dns_reg = "SearchList"
        $long_domain = /[A-Za-z0-9\-\.]{500,}/
    condition:
        $crash_sig and $dns_reg and $long_domain
}

Sigma Rule

title: OpenVPN DNS Search Domain Poisoning - Service Crash
id: 73c1e23f-8c4e-4b2e-8a4f-6d2b2f5c7a0e
status: experimental
description: Detects service crash of OpenVPN interactive service caused by crafted search domain
author: Valters IT
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7031
        ServiceName: 'OpenVPNServiceInteractive'
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: high

title: OpenVPN DNS Search Domain Pollution - Registry Anomaly
id: f9b8c7d6-e5a4-3b2c-1d0e-9f8e7d6c5b4a
status: experimental
description: Detects anomalous length of DNS SearchList registry value
author: Valters IT
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 1 (Process creation)
        CommandLine|contains: 'Set-ItemProperty'
        TargetObject|endswith: 'Tcpip\Parameters\SearchList'
    condition: selection
falsepositives:
    - Administrative changes
level: medium

Suricata Rule

alert tcp any any -> any 1194 (msg:"CVE-2026-13379 OpenVPN Crafted Search Domain in PUSH_REPLY"; flow:established; content:"|70 75 73 68 5f 72 65 70 6c 79|"; depth:256; content:"dhcp-option DOMAIN-SEARCH"; nocase; pcre:"/dhcp-option DOMAIN-SEARCH [A-Za-z0-9\-\.]{500,}/"; sid:10000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Monitor OpenVPN official releases for a patched version (currently none available). Consider downgrading to pre-alpha 2.6.x if possible.
2. Workaround: Add pull-filter ignore "dhcp-option" in client configuration to block server‑supplied search domains.
3. Network Segmentation: Isolate OpenVPN servers to trusted internal infrastructure only.
4. Monitoring: Implement the detection rules above. Set alerts on DNS registry changes.
5. Registry Hardening: Use Group Policy to protect SearchList key with appropriate ACLs (only SYSTEM should write).
6. Crash Response: Configure automatic service recovery (restart) and collect crash dumps for analysis.
7. Vendor Coordination: Report to OpenVPN security contact if not already acknowledged.

Report generated by Valters IT DevSecOps & CTI System