Adios-hola VPN Critical exploit

Source: http://pastebin.com/raw.php?i=Rcp8iY8z
--
____________ __ ________ _________ _____________
||\ /\ \\-( a d i o s )-|||
||||
| /\ | __ \\__/ ___s!\ ___ \ | | | ___ | | -+- | |
| \__/ | \_> >|/\_ \ \\_> | |/\| | _ |__|
| __ | / | <_> >\_> / | _ | <_> > | | |\
|__\/__|____/|___|\___/\_____/---( h o l a ! )-|___|___|\___/|__|__|__|__/
|
|
|______________________________________________________________________________|
) shitty linedrawing by slipstream/RoL may 2015! (


Hola Security Advisory
~~~~~~~~~~~~~~~~~~~~~~

Title: Multiple Critical Vulnerabilities in Hola Overlay Network Client.

# Overview

Hola 'Unblocker' / Hola 'Better Internet' / Hola 'VPN' is a commercial service offered on a
'freemium' basis that advertises itself variously as a censorship-evasion and
privacy/anonymity-enhancement tool. The number of users is difficult to quantify objectively,
but estimates range from 8 million users at the low end, to 42 million users as claimed on the
Hola website.

The Hola Unblocker Windows client, Firefox addon, Chrome extension and Android application
contain multiple vulnerabilities which allow a remote or local attacker to gain code execution
and potentially escalate privileges on a user's system. Additional design flaws allow a Hola
user to be tracked across the internet via a persistent ID. Furthermore, as Hola users -
wittingly, or otherwise - act as exit-nodes for the overlay network, each is capable of acting
as a Man-in-the-Middle for other users of the free or premium Hola network, or its commercial
'bandwidth' service, Luminati, and thereby compromising the privacy and anonymity of their
browsing and exposing them to further attacks.

# Issues

The Hola software creates an API server listening on port 6853 of the loopback interface
(127.0.0.1). The server exposes JSON and other endpoints over HTTP, setting an
"Access-Control-Allow-Origin: *" CORS header, which allows a remote website to read the
responses for requests to these endpoints, and thereby enumerate sensitive information, as
well as affecting the security and integrity of the system.

1. Local File Read

The "/file_read.json" endpoint allows a remote website to read arbitrary files on the local
system via path traversal. The files can be read up to the first null byte.

2. Information Disclosure

* The "/callback.json" endpoint provides uniquely identifying information about the users
local Hola install. An attacker could exploit this issue to persistently track a Hola user
across the Internet. When nodes are acting as exit nodes, they also obtain implicit unique
identifiers for the traffic they relay, compounding the privacy concerns.

* The "/procinfo/ps" endpoint provides internal debugging information of the Hola software.
With certain query arguments, the information provided contains pointers to functions that can
be used to defeat ASLR (Address space layout randomization). This would make it easier for an
attacker to exploit memory corruption, such as a buffer overflow and other vulnerabilities,
potentially allowing the attacker to achieve remote code execution in the context of the
service in conjunction with other bugs.

As it happens, remote code execution is achieved without the use of the infoleak.

3. Remote Code Execution

* The "/vlc_mv.json" endpoint allows files on the local system to be moved. The
"/vlc_start.json" endpoint allows for the bundled VLC executable to be run with full
controlled arguments. Together these vulnerabilities can be utilized to gain arbitrary
remote code execution. Details will be fully disclosed at the discretion of the researchers
when some time has elapsed for users to remove the software.

* If an attacker can perform a Man-in-the-Middle attack against a target running the Hola
client on Windows - either as a network adversary, ISP, intelligence agency or another Hola
client acting as an exit node -- they can create a connection seeming to originate from the
hola.org or client.hola.org hosts to the local websocket port.

This web socket connection can be used to download a remote file and execute it with either
the privileges of the logged in user, or as SYSTEM, depending on what version of the client is
installed (browser extension or Windows client). The Android app is also affected by this
vulnerability, which can be used to remotely execute arbitrary code as the Hola app user. An
XSS vulnerability on the hola.org or client.hola.org domains could also allow an attacker to
exploit this issue to remotely execute arbitrary code.

4. Privilege Escalation

The Hola software creates a websocket server listening on port 6863 of the loopback interface.
The software checks the Origin header against some whitelisted values, but this can be spoofed
if RCE has been achieved. The Windows client runs its service (hola_svc.exe) as SYSTEM. The
websocket server allows access to commands implemented within the service such as "wget",
which downloads a file from a remote server, and "exec" which executes a file with the same
privileges as the service. Therefore, the websocket can be abused to escalate privileges if
the Windows client is installed.

# Affected Versions

Hola Engine for Windows and the Hola Firefox addon on Windows are vulnerable to the first
described remote code execution vulnerability. Hola Engine for Windows is also vulnerable to
the privilege escalation issue. These versions along with the "Chrome app on Windows" .crx
extension (hola_chrome_ext_dll_1.7.333.crx) distributed on the Hola website and the Hola
Android app are vulnerable to the second described remote code execution issue, the
information disclosure and local file read issues.

# Solution

No solution yet exists. Uninstallation of the Hola service, Firefox addon and Android
application will prevent exploitation of these issues. To fully uninstall the Firefox addon,
%localappdata%\Hola must also be deleted. The researchers cannot sanction any mitigations
except to remove this software definitively from any affected devices. To fully uninstall Hola
Engine for Windows, in some cases, deletion of C:\Program Files\Hola is also needed.

--

Engine for Windows, in some cases, deletion of C:\Program Files\Hola is also needed.