# Leakage of traffic in plaintext towards the IP address of VPN server

Mozilla VPN on Linux and Android routes traffic to the VPN server's own IP outside the tunnel, leaking plaintext TCP packets that can deanonymize users.

- Payout: hidden
- Severity: low
- Program: Mozilla
- Found by: vanhoefm
- Disclosed: 2024-11-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1987687
- Library page: https://bugbountylibrary.com/r/h1%3A1987687
- Tags: area:devices domain:network impact:data-leak kind:bounty platform:hackerone sev:low tech:android tech:linux technique:recon vuln:info-disclosure

**Target:** VPN client routing on Linux and Android
**Root cause:** The VPN client excludes traffic destined to the VPN server's IP from the tunnel, but this exclusion applies to all traffic to that IP, not just the client's own encrypted tunnel packets, so user-initiated connections to the server IP bypass the tunnel.
**Steps:**
1. Enable the VPN connection.
2. Identify the VPN server IP (sniff traffic or try known server IPs).
3. In a browser visit `http://<SERVERIP>/`.
4. Filter Wireshark with `tcp.port == 80` to observe the plaintext TCP SYN sent outside the tunnel.
5. Alternatively run `vpn_tester.sh --vpn-serverip <IP>` which redirects port 80 traffic to a local web server; receiving the HTTP request confirms the leak.
**How found:** Part of a broad study testing 66+ VPNs; researchers hypothesized that traffic to the VPN server IP might bypass the tunnel and confirmed by visiting the server IP in a browser while capturing packets, observing plaintext TCP SYNs outside the tunnel.
**Exploitation:** Attacker tricks victim into loading a URL resolving to the VPN server IP (via message-board image, chat link preview, XSS, or compromised site). A network-positioned adversary (e.g. malicious Wi-Fi AP) uses `iptables -t nat -I PREROUTING -p tcp -d $SERVERIP --dport 80 -j REDIRECT --to 80` to capture the plaintext request and serve arbitrary content; a powerful adversary monitoring citizen traffic correlates the plaintext packet to deanonymize the VPN user.
**Escalation:** Combined with DNS spoofing (on other vendors' clients) could leak arbitrary traffic; here limited to deanonymization and reputational impact.
**Insight:** When a VPN client excludes the server IP from the tunnel, test whether user-initiated connections to that same IP also bypass the tunnel — the exclusion should be scoped to the client's own socket/UID, not the destination IP.