CVE-2020-26050: 
SaferVPN vulnerability analysis and mitigation

SaferVPN for Windows versions 5.0.3.3 through 5.0.4.15 contains a local privilege escalation vulnerability tracked as CVE-2020-26050. The vulnerability was discovered in July 2020 and publicly disclosed on January 12, 2021, after the vendor failed to address the issue within the 90-day disclosure deadline (Binary Blog).

The vulnerability occurs when SaferVPN attempts to connect to a VPN server by spawning openvpn.exe in the context of NT AUTHORITY\SYSTEM. The application tries to load an openssl.cnf configuration file from a non-existent folder (C:\etc\ssl\openssl.cnf). Since low-privileged users can create folders under C:, an attacker can create the appropriate path and place a crafted openssl.cnf file. When openvpn.exe service starts, it loads the malicious OpenSSL engine library specified in the crafted configuration file, resulting in arbitrary code execution with SYSTEM privileges (Binary Blog).

This vulnerability allows local attackers with low privileges to escalate their privileges to SYSTEM level on Windows systems running SaferVPN. This enables complete system compromise, as attackers can execute arbitrary code with the highest system privileges (Binary Blog).

The vulnerability is relatively easy to exploit and requires only local access to the system. A proof of concept exploit has been publicly disclosed that demonstrates how to achieve privilege escalation by creating a malicious openssl.cnf file and corresponding DLL to obtain a reverse shell with SYSTEM privileges (Binary Blog).

No official patch was released by the vendor even after the 90-day disclosure deadline. Users of affected versions should consider using alternative VPN solutions or implementing strict access controls to prevent local users from creating directories in the C:\ root directory (Binary Blog).