Exploit released for critical Windows CryptoAPI spoofing bug

guest · Jan 25, 2023

By Sergiu Gatlan @serghei - January 25, 2023

Proof of concept exploit code has been released by Akamai researchers for a critical Windows CryptoAPI vulnerability discovered by the NSA and U.K.'s NCSC allowing MD5-collision certificate spoofing.
Click to expand...

Tracked as CVE-2022-34689, this security flaw was addressed with security updates released in August 2022, but Microsoft only made this public in October, when the advisory was first published.

"An attacker could manipulate an existing public x.509 certificate to spoof their identity and perform actions such as authentication or code signing as the targeted certificate," Microsoft explains.
Unauthenticated attackers can exploit this bug (tagged by Redmond as critical severity) in low-complexity attacks.
Click to expand...

Today, security researchers with the Akamai cloud security firm have published a proof of concept (PoC) exploit and shared an OSQuery to help defenders detect CryptoAPI library versions vulnerable to attacks.

"We have searched for applications in the wild that use CryptoAPI in a way that is vulnerable to this spoofing attack. So far, we found that old versions of Chrome (v48 and earlier) and Chromium-based applications can be exploited," the researchers said.
"We believe there are more vulnerable targets in the wild and our research is still ongoing. We found that fewer than 1% of visible devices in data centers are patched, rendering the rest unprotected from exploitation of this vulnerability."
Click to expand...

Akamai: Exploiting a Critical Spoofing Vulnerability in Windows CryptoAPI

By Tomer Peled and Yoni Rozenshein - January 25, 2023
Executive summary

Akamai Security Research recently analyzed a critical vulnerability in Windows CryptoAPI that was disclosed by the National Security Agency (NSA) and the National Cyber Security Center (NCSC) to Microsoft.

The vulnerability, assigned CVE-2022-34689, has a CVSS score of 7.5. It was patched in August 2022, but was publicly announced in the October 2022 Patch Tuesday.

According to Microsoft, the vulnerability allows an attacker to masquerade as a legitimate entity.

The root cause of the bug is the assumption that the certificate cache index key, which is MD5-based, is collision-free. Since 2009, MD5’s collision resistance is known to be broken.

Click to expand...

The attack flow is twofold. The first phase requires taking a legitimate certificate, modifying it, and serving the modified version to the victim. The second phase involves creating a new certificate whose MD5 collides with the modified legitimate certificate, and using the new certificate to spoof the identity of the original certificate’s subject.

We have searched for applications in the wild that use CryptoAPI in a way that is vulnerable to this spoofing attack. So far, we found that old versions of Chrome (v48 and earlier) and Chromium-based applications can be exploited. We believe there are more vulnerable targets in the wild and our research is still ongoing.

We found that fewer than 1% of visible devices in data centers are patched, rendering the rest unprotected from exploitation of this vulnerability.

In this blog post, we provide a detailed explanation of the potential attack flow and consequences, as well as a proof of concept (PoC) that demonstrates the complete attack. We also provide an OSQuery for detecting vulnerable versions of the CryptoAPI library.

Click to expand...

EASTER · Jan 25, 2023

"We believe there are more vulnerable targets in the wild and our research is still ongoing. We found that fewer than 1% of visible devices in data centers are patched, rendering the rest unprotected from exploitation of this vulnerability."
Click to expand...

Log in or Sign up

Exploit released for critical Windows CryptoAPI spoofing bug

guest Guest

EASTER Registered Member

Log in or Sign up

Exploit released for critical Windows CryptoAPI spoofing bug

guest Guest

EASTER Registered Member

Useful Searches