S2OPC Toolkit Certificate Trust List Check Bypass Vulnerability

Vulnerability Overview Title: Certificate Trust List Check issue: well-formed untrusted certificate might be considered trusted Description: During certificate validation, all certificate validation steps (as described in Part 6, v1.05.06) are applied when validating the peer certificate. However, during the Trust List Check step, the comparison is performed against the matching certificate in the peer certificate chain, rather than against the trusted certificates. This comparison may be incomplete, potentially leading to certificates with the same subject name and the same certificate length but different keys being treated as matches. Only the first few bytes corresponding to the subject length are compared, rather than the entire certificate length. Note: - Since all other validation steps are applied, the certificates in the certificate chain must be valid (though they may be untrusted), and all other steps must succeed. - This issue affects both the MbedTLS wrapper and the CycloneCrypto wrapper. Impact Scope Code Version and Environment Identifiers: - This issue exists starting from release version 1.5.0. - In the master branch, the commit ID is b307f675. Remediation Reproduction Steps: 1. Create a self-signed certificate using a new key. 2. Create another certificate with the same configuration (same subject name and total length) and a new key, forcing its serial number value to be smaller than that of the first certificate. 3. Add the second certificate to the trusted server PKI. 4. Successfully connect to the server using the second certificate, even though the attacker's certificate is actually untrusted. POC Code Additional Information Status: Closed Created: 3 weeks ago Creator: Vincent Monfort Labels: Client, Security, Server Milestone: S2OPC_Toolkit1.7.3 Participants: 3

Goal Reached Thanks to every supporter — we hit 100%!

S2OPC Toolkit Certificate Trust List Check Bypass Vulnerability

More from this source