CVE-2020-25744: 
SaferVPN vulnerability analysis and mitigation

SaferVPN for Windows before version 5.0.3.3 contained a vulnerability that allowed low-privileged users to create or overwrite arbitrary files, potentially leading to a denial of service (DoS) condition. The vulnerability, tracked as CVE-2020-25744, was discovered on September 8, 2020, and was silently fixed by the vendor on September 16, 2020 (Medium Blog).

The vulnerability stems from improper file access control in SaferVPN's logging mechanism. The application spawns openvpn.exe with SYSTEM privileges, which creates log files named xxx_ovpn.log under %USERPROFILE%\AppData\Local\SaferVPN\Log. Due to users having full control over the log folder, they could delete existing files and create symbolic links pointing to privileged system files. When openvpn.exe attempts to write logs, it follows these symbolic links, potentially overwriting critical system files (Medium Blog). The vulnerability has a CVSS v3.1 base score of 8.1 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) (NVD).

The primary impact of this vulnerability is the potential for denial of service through arbitrary file overwrites. While an attacker has limited control over the content being written, they can target critical system files, potentially disrupting system operations. The vulnerability requires local user access to exploit (Medium Blog).

The vulnerability can be exploited by deleting files under the SaferVPN log folder and creating a symbolic link pointing to a privileged file (e.g., C:\Windows\win.ini). When a user connects to the VPN, the openvpn.exe process follows the symbolic link and overwrites the target file with log contents. A proof-of-concept exploit has been publicly demonstrated (Medium Blog).

The vulnerability was fixed in SaferVPN version 5.0.3.3. The fix involves relocating the log folder to C:\ProgramData\Mudhook Marketing, Inc\SaferVPN\Diagnostics\Service with proper permissions and eliminating the creation of country-specific log files. Users should upgrade to version 5.0.3.3 or later to mitigate this vulnerability (Medium Blog).