MitM attack in Fortinet FortiClient

1) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU91755

Risk: Medium

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-3661

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to way the VPN client handles routes advertised by the DHCP server. A remote attacker with access to the local network can route the victim's traffic to a malicious server instead of sending it via a secured channel. 

This vulnerability was dubbed "TunnelVision".

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Fortinet FortiClient for Windows: 0 - 7.2.4

FortiClient (Linux): 6.0.0 - 7.2.4

FortiClient (macOS): 5.6.6 - 7.2.4

CPE2.3

• cpe:2.3:a:fortinet:fortinet_forticlient:0:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:1.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:1.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:4.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:4.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:4.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:4.3.3.445:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:5.0.11:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:5.2.028:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:fortinet_forticlient:5.4.5:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:forticlient_linux:6.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:fortinet:forticlient_macos:5.6.6:*:*:*:*:*:*:*

External links

https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://tunnelvisionbug.com/
https://www.leviathansecurity.com/research/tunnelvision
https://news.ycombinator.com/item?id=40279632
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://issuetracker.google.com/issues/263721377
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://news.ycombinator.com/item?id=40284111
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
https://www.fortiguard.com/psirt/FG-IR-24-170

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.