Researchers at
SEC Consult have discovered a CSRF vulnerability in the OpenVPN Desktop
Client that can allow remote code execution.

“All Access Server
customers using the ‘Desktop Client’ app for Windows should upgrade
immediately to the OpenVPN Connect client.  The ‘Desktop Client’ is
obsolete and is no longer maintained or available for download. This
client contains a CSRF (Cross Site Request Forgery) vulnerability that
can allow remote code execution by a malicious web site,” 
“It is also bundled with an older
version of OpenSSL that has not received recent OpenSSL security
updates.  This advisory only applies to the OpenVPN Access Server
‘Desktop Client’ app for Windows, and does not affect OpenVPN Connect,
Private Tunnel, or community builds of OpenVPN for Windows.” OpenVPN
reported in the advisory.

“Remote
attackers can execute arbitrary code and execute other attacks on
computers with the OpenVPN Access Server “Desktop Client” installed.
Affected users should upgrade immediately to the OpenVPN Connect
client.” the SEC Consult advisory states.

“The
OpenVPN Access Server ‘Desktop Client’ consists of two parts, a Windows
service that offers an XML-RPC API via a webserver on localhost and a GUI component that connects to this API,” 

“The XML-RPC API is vulnerable to Cross-Site Request Forgery (CSRF). Using the API commands an attacker can: unmask a victim (e.g. by
disconnecting an established VPN connection), perform MITM attacks (by
connecting the victim to an ‘evil’ VPN server), execute arbitrary code
with SYSTEM privileges (by adding a VPN profile that executes code).”

SEC Consult has provided a video proof of concept for the OpenVPN Access Server ‘Desktop Client’ vulnerability.