AWS Client VPN Windows Client Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the AWS Client VPN Windows client. During installation, the process references a specific directory to retrieve the OpenSSL configuration file. This allows a non-administrative user to insert arbitrary code into the configuration file. If an administrative user then initiates the installation, the inserted code could be executed with elevated privileges. This vulnerability is not present in the Linux or Mac versions of the client.

Impact

Exploitation of this vulnerability allows for local privilege escalation, where a non-admin user can execute code with administrative rights during the AWS Client VPN installation process.

Remediation

Users are advised to upgrade to AWS Client VPN version 5.2.2 or later. For those using versions prior to 5.2.2, it is recommended to discontinue any new installations of the AWS Client VPN Windows client.