GHSA-hqmp-g7ph-x543 TunnelVision - decloaking VPNs using DHCP
Attackers can bypass VPN encryption by injecting routing entries via DHCP option 121, redirecting traffic to the local network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-hqmp-g7ph-x543?
GHSA-hqmp-g7ph-x543 is a vulnerability in quincy, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection.
Impact
All users are potentially affected, as this attack vector can be used against any VPN implementation without mitigations in place.
Patches
Currently, there are no existing mitigations employed by Quincy.
Workarounds
Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack.
References
Which versions are affected by GHSA-hqmp-g7ph-x543?
2 open source packages ship an affected version, including quincy.
| Package | Affected | Fixed in |
|---|---|---|
quincy crates.io | All versions to 0.13.0 | None |
quincy crates.io | All versions to 0.13.0 | None |
How do I fix GHSA-hqmp-g7ph-x543?
No fix has been published for GHSA-hqmp-g7ph-x543 yet. Limit exposure of the affected software until one is available.
Is GHSA-hqmp-g7ph-x543 being exploited?
There is no known exploitation of GHSA-hqmp-g7ph-x543 in the wild and no public exploit code.