One of the main reasons why people use VPNs is for security reasons. Whether it is companies or individuals, they want a layer of protection and privacy, so problems of this type eliminate any hint of trust and usefulness of VPNs. A SUSE cybersecurity researcher has warned that Mozilla's VPN client for Linux presents a serious vulnerability.
That issue could allow threat actors to carry out a wide range of integrity violations. Matthias Gerstner posted an article on the Openwall security mailing list. It details a broken authentication check in Mozilla's VPN client v2.14.1, released on May 30. With that flaw you can configure your own arbitrary VPN, redirect network traffic to potentially malicious destinations, and break existing VPN configurations.
The Mozilla VPN client on Linux is a huge security hole
Detailing the flaw, Gerstner says that SUSE engineers analyzed Mozilla's VPN client and discovered that "contains a D-Bus privileged service running as root and a Polkit policy«. The Polkit is an authorization API for privileged programs which checks if the Mozilla VPN D-Bus privileged service is authorized to perform certain actions, instead of the user.
Matthias Gerstner explained what this problem of checking the VPN and not the user means. With this an arbitrary local user can configure an arbitrary VPN configuration using Mozilla VPN and thus possibly redirect network traffic to malicious parties. They would pretend that a secure VPN is present when in fact it is not, could perform a denial of service against an existing VPN connection, or perform other integrity violations.
SUSE communicated its findings to Mozilla, which after several days found the bug revealed in a GitHub pull request to the Mozilla VPN repository. Three months later, as usual, SUSE made the ruling public. It is now being tracked as CVE-2023-4104.
Source: TechRadar
