CVE-2023-7245 Code injection in OpenVPN Connect
A local attacker can execute arbitrary code in the OpenVPN Connect application by exploiting improper Node.js configuration via environment variables.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7245?
CVE-2023-7245 is a high-severity code injection vulnerability in OpenVPN Connect, published on 20 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
Weakness: CWE-95
Which versions are affected by CVE-2023-7245?
It affects 1 product.
Products include Openvpn Connect.
How do I fix CVE-2023-7245?
No fix has been published for CVE-2023-7245 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-7245 being exploited?
There is no known exploitation of CVE-2023-7245 in the wild and no public exploit code.
Other vulnerabilities in OpenVPN Connect
Sources
Also known as GHSA-pr57-r6pp-3h3h.