Gateway can forward traffic to arbitrary hosts

Summary

DNS Resources rely on the Client assigning each resolved domain a placeholder ("proxy") IP address from a reserved range, then telling the Gateway which proxy IPs it allocated for a resource. The Gateway installed these proxy IPs without checking that they fall inside the reserved ranges (100.96.0.0/11 for IPv4, fd00:2021:1111:8000::/107 for IPv6).

The Gateway's NAT for DNS Resources only rewrites destinations inside the reserved ranges. Traffic for other destinations is forwarded as-is. The missing check as to whether the proxy IP is within the reserved ranges caused the Gateway to classify this traffic as "not a DNS Resource" and forward it without applying the NAT.

Impact

A Client authorized for at least one DNS Resource on a Gateway could send traffic to, and receive traffic from, any IP address that Gateway can reach, subject only to the port and protocol filters configured on that DNS Resource. This bypasses the boundary that otherwise confines a Client to the Resources its Policies grant, so hosts on the Gateway's network that no Policy covers could be reached.

To exploit this, an attacker needs to have legitimate access to the Firezone account, a Policy granting access to a DNS Resource, and modify the Client to send proxy IPs from outside the reserved ranges. It is not reachable by an unauthenticated attacker, and unmodified Clients only ever assign proxy IPs from within those ranges.

We have found no evidence that this vulnerability was exploited, or that exploitation was attempted.

Remediation

Upgrade affected Gateways to 1.6.1 or later; see upgrading.

1.6.1 validates every proxy IP against the reserved ranges before any NAT state is created, and rejects the whole request if any of them falls outside.

Credits

Reported by Elias Hasas.