CVE-2024-3661
HIGHFortiClient 6.4.0-7.2.4 - Unauthenticated VPN Traffic Leak via DHCP Classless Static Route Option
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-3661. PoCs published by YardenFadida, Roundthe-clock, Wh1t3Fox.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-3661, which involves a DHCP Option 121 injection attack. The exploit uses NetfilterQueue to intercept and modify DHCP traffic, injecting custom routes to redirect traffic through an attacker-controlled gateway.
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Exploits (3)
This repository contains a functional exploit for CVE-2024-3661, which involves a DHCP Option 121 injection attack. The exploit uses NetfilterQueue to intercept and modify DHCP traffic, injecting custom routes to redirect traffic through an attacker-controlled gateway.
This repository contains functional exploit code for CVE-2024-3661, demonstrating DHCP starvation and malicious DHCP server attacks using Scapy. The scripts include DHCP offer manipulation with Option 121 and IPv6 Router Advertisement spoofing.
References (20)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L