chrisrenault Hi, I'm testing OpenVPN Access Server and found that I can browse to a unauthenticated page: https://[server IP address]:1543/html/downloads.html?v=1400015421 There's no direct result for the directory browsing, no commands issued or privilege escalation, but it seems to be a flaw. There's any switches or configuration files in order to prevent this behaviour ? Thanks in advance.
The Johan I cannot replicate this here. Are you _SURE_ you are getting this result from the OpenVPN Access Server itself, and not some other service running on that port?
chrisrenault Got only OpenVPN AS running on the server and the "flaw" is intermittent. Here is a screenshot: https://imgur.com/a/9PzIOEY
The Johan Can't seem to reproduce this on any of my access servers. I also don't recognize that URL, it's not even a URL we use in access server. I suggest you open a support ticket on the openvpn.net website and submit these details and what you've done exactly, and we can then have a closer look at it.
