CVE-2023-36673: Avira Phantom VPN Data Leak Vulnerability

CVE-2023-36673 Overview

CVE-2023-36673 is a critical vulnerability affecting Avira Phantom VPN through version 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel. This occurs even when the traffic is not generated by the VPN client itself, while simultaneously using plaintext DNS to look up the VPN server's IP address. This flaw allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel.

This vulnerability is part of a broader class of VPN security flaws known as the "TunnelCrack" attacks. The TunnelCrack Security Analysis uses this CVE ID to refer more generally to the "ServerIP attack, combined with DNS spoofing, that can leak traffic to an arbitrary IP address" affecting multiple VPN implementations.

Critical Impact

Attackers on an adjacent network can intercept sensitive traffic in plaintext by exploiting insecure VPN routing configurations combined with DNS spoofing, completely bypassing VPN encryption protections.

Affected Products

• Avira Phantom VPN through version 2.23.1 for macOS
• Other VPN clients potentially affected by the TunnelCrack ServerIP attack class

Discovery Timeline

• 2023-08-09 - CVE-2023-36673 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36673

Vulnerability Analysis

This vulnerability stems from a fundamental design flaw in how Avira Phantom VPN configures macOS network routing rules. The VPN client creates an exception that allows plaintext traffic destined for the VPN server's IP address to bypass the encrypted tunnel. Combined with the use of unencrypted DNS queries for resolving the VPN server's hostname, this creates an exploitable condition.

An attacker positioned on the same network segment can perform DNS spoofing to return a malicious IP address when the victim's system queries for the VPN server. Since traffic to this IP address is configured to bypass the tunnel, sensitive data intended for the legitimate VPN server gets sent in plaintext to the attacker-controlled destination.

The vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information), highlighting the core issue of sensitive traffic being transmitted without encryption when users expect VPN protection.

Root Cause

The root cause lies in the VPN client's insecure network configuration approach:

1. Plaintext Server Route Exception: The VPN client configures macOS routing tables to send all traffic destined for the VPN server's IP address outside the encrypted tunnel in plaintext. This is a common but insecure pattern used by VPN clients to establish and maintain the VPN connection.

2. Unencrypted DNS Resolution: The VPN client uses plaintext DNS (not DNS-over-HTTPS or DNS-over-TLS) to resolve the VPN server's hostname, making it vulnerable to DNS spoofing attacks.

3. Missing Traffic Validation: The VPN client does not validate that traffic being sent to the "VPN server IP" is actually VPN control traffic versus arbitrary user data.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same local network as the victim (such as a public Wi-Fi network, compromised router, or malicious access point).

The attack proceeds as follows:

1. The attacker monitors for DNS queries from the victim for the VPN server's hostname
2. The attacker responds with a spoofed DNS response containing a malicious IP address
3. The victim's VPN client accepts the spoofed response and configures the system to route plaintext traffic to this address
4. Any traffic the victim sends to the "VPN server" now goes in plaintext to the attacker
5. The attacker can capture sensitive data, credentials, or inject malicious content

This attack is particularly dangerous on untrusted networks where users specifically rely on VPNs for protection.

Detection Methods for CVE-2023-36673

Indicators of Compromise

• Unexpected DNS responses for VPN server hostnames with different IP addresses than expected
• Network traffic destined for the VPN server's IP that is not encrypted
• ARP spoofing or DNS cache poisoning artifacts on the local network
• Unusual routing table entries on macOS systems running Avira Phantom VPN

Detection Strategies

• Monitor for DNS query responses that do not match expected VPN server IP addresses
• Implement network-level detection for DNS spoofing attacks using techniques like DNSSEC validation
• Analyze network traffic for plaintext data being sent to unexpected IP addresses when VPN is active
• Deploy endpoint detection to identify routing table manipulations on macOS systems

Monitoring Recommendations

• Configure SIEM rules to alert on DNS response anomalies for known VPN server hostnames
• Monitor for unusual outbound plaintext traffic from systems with active VPN connections
• Implement network segmentation monitoring to detect adjacent network attacks
• Review VPN client logs for connection establishment anomalies

How to Mitigate CVE-2023-36673

Immediate Actions Required

• Update Avira Phantom VPN to the latest available version if a patch has been released
• Avoid using affected VPN versions on untrusted networks such as public Wi-Fi
• Consider switching to VPN clients that implement proper tunnel protection against TunnelCrack attacks
• Enable DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) at the system level where possible

Patch Information

Users should check the Avira Free VPN Overview page for the latest version and security updates. The TunnelCrack Security Analysis provides detailed information about which VPN clients have been patched and their current vulnerability status.

Additionally, the SonicWall Vulnerability SNWLID-2023-0015 advisory provides related guidance for SonicWall products affected by similar TunnelCrack vulnerabilities.

Workarounds

• Use VPN services that implement proper DNS security (DNSSEC, DoH, or DoT)
• Configure manual static DNS servers that support encrypted DNS
• Avoid connecting to untrusted networks when VPN protection is critical
• Use a firewall to block all non-VPN traffic when the VPN is intended to be active
• Consider using VPN providers that have confirmed mitigations for TunnelCrack attacks

# macOS workaround: Configure DNS-over-HTTPS using Cloudflare's 1.1.1.1 service
# This helps mitigate DNS spoofing attacks
networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1

# Verify DNS configuration
networksetup -getdnsservers Wi-Fi

# Monitor active routes for suspicious entries
netstat -rn | grep -E "^default|UGSc"