AI
ZTNA Deployed as a Legacy VPN Replacement
Organizations panicked about Ivanti bugs and moved to ZTNA. Most replaced their VPN and used the new product identically: no granular access controls, just brokering connections to the internal network. The situation got worse. Many adopted a “trusted corporate LAN” model inside shared ZTNA infrastructure, meaning they share IP space with every other customer of that product. Some conditional access policies excluded MFA for ZTNA IP ranges to reduce friction, letting anyone from those shared IPs skip authentication entirely.
Checkpoint Harmony: Hard-Coded Key and 30-Day JWTs
Checkpoint’s Harmony client stores a private SSH key encrypted in the binary with a hard-coded AES key and IV. That key uploads log files to an SFTP server. The encryption on those log files used a predictable, brute-forceable key. The log files contained JWTs valid for 30 days. Any customer who uploaded logs to Checkpoint support exposed those JWTs, which authenticate directly to the ZTNA service. Checkpoint removed SFTP read access immediately after the report. More Harmony bugs remain in disclosure.
Zscaler: Forged SAML Assertions and Device Token Replay
Zscaler’s SAML flow checked for a signature on the assertion but never validated it against the IdP’s public key. Any key, or no valid key at all, bypassed authentication for every SAML-configured tenant. CVE-2025-54982 is now patched. A separate flaw: device token authentication mode stores tokens in the Windows registry in cleartext. Extracting that token and replaying it on an attacker machine logs in as any username, since the token only validates against the tenant, not a specific user. Switching the username in the registry grants whatever policy that account carries.
Netscope Auth Bypass and the Broken Secure Enrollment Fix
Netscope’s auth flow assigns each tenant an immutable org key that leaks before authentication through the SAML request. The original bug (CVE-2024-7401) let attackers skip the IdP stage entirely using only an org key and target email. Netscope’s fix added secure enrollment with a signed JWT, but the server validated the org key inside the JWT while using the org key in the URL for actual enrollment. Swapping the URL parameter targeted any other tenant. Leaked enrollment tokens found online made this exploitable without being a Netscope customer at all.
Privilege Escalation and Hardware ID Spoofing Across All Products
Every ZTNA product tested shared the same architecture: a low-privilege system tray process and a high-privilege service, connected via IPC. None properly validated the calling process. Path-based checks could be bypassed by injecting into a legitimate process. Every product had at least one IPC method that ran code as SYSTEM. The speakers built a DLL called RedScaler, injected into the ZTNA client, that hooks Windows API calls to spoof hardware IDs and posture checks. Hardware ID computation uses the CPUID instruction, which requires a page-guard exception hook rather than a standard inline hook.
Detection and Mitigation for ZTNA Deployments
Netscope customers still using IDP mode remain fully exposed to the original auth bypass. Zscaler supports cryptographically verified posture checks since version 4.4 but doesn’t enable them by default. Keep clients updated even without a CVE: Netscope doesn’t issue CVEs for server-side fixes. For detection, ingest ZTNA vendor logs and watch for newly registered devices or sudden posture check failures. Enable DPAPI debug logging via the Microsoft-Windows-Crypto-DPAPI event log (event ID 16385) to detect config theft. Configure SACLs on sensitive registry keys to raise event ID 4663 on access.
Notable Quotes
That’s right. Get parameter wins. Rich Warren · ▶ 19:36
We even found leaked enrollment tokens Rich Warren · ▶ 20:05
there are no magic ZT CNA beans. David Cash · ▶ 37:45
Key Takeaways
- ZTNA deployed without granular controls is functionally a VPN with shared IP space and weaker MFA enforcement.
- Zscaler’s SAML auth bypass (CVE-2025-54982) accepted any key or no valid signature for authentication.
- Every ZTNA product tested had an IPC method exploitable from user space to run code as SYSTEM.
- Hardware ID checks and posture profiles can be spoofed by injecting a DLL that hooks Windows API calls.
- Absent a CVE, organizations won’t patch: Netscope’s original auth bypass still worked more than a year after the fix.
About the Speakers
David Cash is a Red Team Operator at AmberWolf, formerly with NCC Group. He co-presented “Very Pwnable Networks: Exploiting the Top Corporate VPN Clients for Remote Root and SYSTEM Shells” at SANS HackFest Hollywood 2024 and has led red team operations uncovering critical flaws in enterprise remote access tools.
Rich Warren is a Red Team Operator at AmberWolf and a Microsoft Top 100 Security Researcher, formerly with NCC Group. He co-presented “Very Pwnable Networks” at HackFest Hollywood 2024 and has a track record of discovering novel vulnerabilities in VPN and zero-trust clients across multiple high-profile disclosures.