Introduction
In this article, we'll explore scenarios in which a VPN fails to provide meaningful protection:
- Vulnerable External Service Exposure (SSRF, RCE)
- Vulnerable Internal Licensed Software (CORS + XSS)
- Insider Threats
- Compromised Endpoints (through Phishing)
- Insufficient Authentication Controls
- Supply Chain Compromise
Vulnerable External Service Exposure (SSRF, RCE)
In the modern times companies often provide Internet services to the clients. However, this is frequently a critical component of running a business it is often a golden target for attackers.
Despite the possibility of obtaining valuable information from the application itself, in some cases a vulnerable service also allows attackers to break into the company’s internal network.
Server Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) lets an attacker make a vulnerable server send HTTP requests on their behalf. That means that attackers are using the server as proxy to reach internal endpoints.
Source: https://www.invicti.com/blog/web-security/server-side-request-forgery-vulnerability-ssrf
Remote Code Execution (RCE)
RCE is as serious as it gets. If an attacker can execute arbitrary code on a web application or any other internet-facing service, the implications are immediate and severe. With code execution on the target, the attacker can not only interact directly with internal components but also fully compromise the host machine. From there, the server becomes a pivot point - a proxy for further attacks into the internal network. At this stage, the attacker is effectively operating inside what should be a VPN-protected, internal environment, with the same level of access as a trusted system.
Source: https://medium.com/@maram.raboudi/pivoting-techniques-8f1df1f3d919
Vulnerable Internal Licensed Software (CORS + XSS)
Nowdays almost all companies use Licensed Software from Providers in order to make their work easier and more efficient. However this apporach greately improves productivity of the employees and sometimes it is crucial to perform business tasks it can also be the reason of our destruction.
Imagine the Intenral server contains Cross Site Scripting and CORS vulnerability.
Source: Own elaboration
With these two vulnerabilities attackers is able to reach, affect and exfiltrate data from internal company network component.
But you might ask: How is the attacker able to craft the payload that is later placed on the malicious website since the web application is only accessible from internal network?
Since the web application we talked about is licensed software the attacker can forge his payload on his own system and then use previously created payload on our system. This kind of payload creation was used in the MoveIT SQL Injection exploit where attackers with pre-written exploit created guest account and then granted him Administrator privileges.
This kind of attacks resulted in $75 000 000 "bounty" for CloP ransomware group.
Insider Threats
Often the attack comes from inside of organization. According to IBM analysis as many as 83% of organizations stated that they had experienced at least one insider attack in the past year.
This highlights a critical reality: while external threats tend to dominate headlines, internal risks whether malicious, negligent, or accidental pose an equally significant challenge.
In the context of reaching internal network / data the case is straightforward.
Source: Own elaboration
Malicious / Bribed employee is not only able to sell his knowledge of the internal organization structure but also make his workstation available to attackers either by providing it in a phisical form or executing connection to C2 server.
This vector of attack resulted in $400 000 000 lost in Coinbase Insider Incident.
Compromised Endpoints (through Phishing)
Access to the internal network in this example paradoxically is very similar to Insider approach but with one key difference.
In this case employee which is attacker's proxy do not colaborate with him but unconsciously share his/hers workstation which makes him more unstable since here the malicious actor also has to care about persistance.
Source: https://cymulate.com/cybersecurity-glossary/command-and-control-c2/
How the malware can be triggered?
- Macros in Microsoft Office documents
- Infected USB devices
- .exe files
- .lnk files
- .hta files
- ...
Insufficient Authentication Controls
In smaller organizations, security is often overlooked because it is perceived as costly or unnecessary. That state of mind leads us to serious negligence when it comes to designing network and configuring its components.
As simple as it may seem, even the most fundamental principles of building secure environments are sometimes ignored. Example below illustrates exactly that problem when it comes to VPN setup.
Source: Own elaboration
When we use not enough Authentication Controls we are exposed to increased risk of unauthorized access, data breaches, and exploitation of weak or missing security barriers. Let's say that our VPN requires only credentials in order to get into the private network.
Source: Own elaboration
In this case succesfull attack can be as simple as setuping credential harvesting website and sending the proper phishing emails with link to our malicious service.
Supply Chain Compromise
In the past year there were a few incidents proving importance of secure supply chain management:
Scale of this kind of attacks was so high that this kind of vulnerability earned its place in the new 2025 OWASP Top Ten.
How do software supply chain attacks happen?
Supply chain attacks exploit the trust relationships embedded in modern development ecosystems. Instead of attacking the final application directly, adversaries compromise one of the components it depends on. This can happen at multiple stages:
- Compromising third-party packages (e.g., NPM, PyPI)
- Compromising build pipelines
- Tampering with repository or artifact integrity
- Dependency Confusion
What is the result of suply chain attack?
Supply chain attacks are particularly dangerous because a single compromise can cascade into thousands of downstream projects. However, the threat goes far beyond simply gaining a foothold in private networks. Such attacks can ultimately serve as a direct pathway into our internal environment.
Conclusion
While VPNs remain an important layer of defense, they are far from a silver bullet.
Modern attackers no longer rely solely on breaching perimeter firewalls. They exploit misconfigurations, poisoned dependencies, trusted employees, and compromised devices to step directly into internal networks - with or without a VPN in place. For this reason, organizations must shift away from the illusion that “internal means safe” and instead adopt a security model built on zero trust principles, continuous monitoring, strong authentication, and rigorous vulnerability management.
