CVE-2023-36672: Clario VPN Information Disclosure Flaw

CVE-2023-36672 Overview

CVE-2023-36672 is an insecure network configuration vulnerability discovered in the Clario VPN client for macOS through version 5.9.1.1662. The vulnerability affects how the VPN client configures the operating system's network routing, allowing traffic destined for local networks to be transmitted in plaintext outside the encrypted VPN tunnel, even when the local network uses non-RFC1918 IP subnets. This flaw is part of a broader class of vulnerabilities known as "TunnelCrack" attacks, specifically the LocalNet attack variant.

An adversary on the same adjacent network can exploit this vulnerability to trick the victim into sending arbitrary IP traffic in plaintext, bypassing the VPN's encryption protections entirely. This exposes potentially sensitive data that users expect to be protected by their VPN connection.

Critical Impact
Attackers on adjacent networks can intercept sensitive traffic that users believe is protected by VPN encryption, leading to confidentiality breaches and exposure of private communications.

Affected Products

Clario VPN for macOS through version 5.9.1.1662

Discovery Timeline

2023-08-09 - CVE-2023-36672 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36672

Vulnerability Analysis

This vulnerability stems from improper network configuration by the Clario VPN client on macOS systems. When a VPN client establishes a tunnel, it should route all network traffic through the encrypted connection. However, the Clario VPN client fails to properly handle routing for local network traffic when the network uses IP address ranges outside the standard RFC1918 private address blocks (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16).

The weakness is classified under CWE-319 (Cleartext Transmission of Sensitive Information), as the vulnerability results in sensitive data being transmitted without encryption when it should be protected by the VPN tunnel.

Root Cause

The root cause lies in the VPN client's network configuration logic that creates exceptions for local network traffic. While VPN clients commonly allow local network access for legitimate purposes (such as accessing local printers or network shares), the Clario VPN client fails to properly restrict this exception to only RFC1918 private address ranges. This oversight allows an attacker to configure a malicious network with non-RFC1918 addresses to capture traffic that the user expects to be encrypted.

Attack Vector

The attack requires the adversary to be on an adjacent network position, such as a rogue Wi-Fi access point or compromised local network. The attacker can configure the network to use non-RFC1918 IP addresses, causing the victim's VPN client to route traffic to these addresses in plaintext rather than through the encrypted VPN tunnel. This is particularly concerning in public Wi-Fi scenarios where attackers can easily set up malicious access points.

The attack flow involves:

The attacker sets up a malicious network using non-RFC1918 IP ranges
The victim connects to this network while using Clario VPN
The VPN client incorrectly classifies traffic to these addresses as "local" traffic
Network traffic bypasses the VPN tunnel and is sent in plaintext
The attacker intercepts and captures sensitive data

For detailed technical analysis of the TunnelCrack vulnerability class, refer to the TunnelCrack Technical Details documentation.

Detection Methods for CVE-2023-36672

Indicators of Compromise

Unexpected plaintext network traffic originating from systems with active VPN connections
Network traffic to non-RFC1918 address ranges bypassing VPN interfaces
DNS queries or HTTP/HTTPS traffic visible on local network interfaces while VPN is supposedly active

Detection Strategies

Monitor for network traffic that bypasses VPN tunnel interfaces on macOS systems running Clario VPN
Implement network intrusion detection to identify plaintext sensitive traffic from devices that should be using VPN encryption
Use packet capture analysis to verify all expected traffic routes through VPN tunnel interfaces
Deploy endpoint monitoring to detect routing table configurations that create exceptions for non-RFC1918 addresses

Monitoring Recommendations

Enable verbose logging on network interfaces to track traffic routing decisions
Implement alerting for any cleartext traffic containing sensitive data from VPN-enabled endpoints
Regularly audit routing tables on systems running vulnerable VPN client versions
Monitor for rogue access points in enterprise environments that could be used to exploit this vulnerability

How to Mitigate CVE-2023-36672

Immediate Actions Required

Upgrade Clario VPN for macOS to a version newer than 5.9.1.1662 that addresses this vulnerability
Avoid using untrusted or public Wi-Fi networks until the VPN client is updated
Consider using alternative VPN solutions that have been verified to protect against LocalNet attacks
Enable strict firewall rules to block all non-VPN traffic when VPN is intended to be active

Patch Information

Users should check the Clario VPN for Mac product page for the latest version that addresses this vulnerability. The Mullvad Blog on TunnelCrack Response provides additional context on how VPN providers have responded to this class of vulnerabilities.

Workarounds

Configure host-based firewall rules to block all traffic that doesn't route through the VPN interface when VPN is active
Avoid connecting to networks that use non-standard IP address ranges
Use network monitoring tools to verify all traffic is properly routed through the VPN tunnel
Consider implementing a kill switch mechanism that blocks all internet traffic if the VPN connection drops or traffic leaks are detected

bash

# Example macOS firewall configuration to block non-VPN traffic
# Note: Replace utun0 with your actual VPN interface name
sudo pfctl -e
echo "block drop quick on en0 proto { tcp, udp } from any to any" | sudo pfctl -f -
echo "pass quick on utun0 all" | sudo pfctl -f -