phpseclib X.509 SSRF via Authority Information Access URL Validation

Vulnerability Overview X.509 Certificate Verification Triggers Outbound Requests Controlled by an Attacker (Server-Side Request Forgery) via Authority Information Access Vulnerability Description: When an application uses phpseclib to validate untrusted X.509 certificates, reads the Authority Information Access (AIA) URL from the certificate and initiates an outbound request. This request is unrestricted, allowing an attacker to exploit this vulnerability for Server-Side Request Forgery (SSRF). Impact: Attackers can probe internal networks, scan ports, access cloud metadata endpoints, and more. Affected Versions Affected Versions: - >=0.1.1, =2.0.0, =3.0.0, <3.0.53 Fixed Versions: - 1.0.30 - 2.0.55 - 3.0.54 Remediation Recommended Remediation Measures: - Disable URL fetching functionality using the method. - Set to before validating the certificate. - Update to the fixed versions listed above. Proof of Concept (POC) Code Building a Malicious Certificate Starting a Listener Reproduction on LTS 3.0.53 Reproduction on 4.0 Development Branch Impact Internal Reconnaissance and Port Scanning: Connection success/failure and timing reveal internal hosts and ports. Interaction with Internal HTTP Services: Such as admin panels, dashboards, and Webhooks bound to loopback or private addresses. Accessing Cloud Metadata Endpoints: Such as 169.254.169.254, which are typically used to obtain information from cloud providers. Recommended Remediation Measures Disable URL Fetching: Use the method. Update to Fixed Versions: Ensure usage of the fixed versions listed above. Documentation Update: Clearly state in the documentation that validating untrusted certificates may result in outbound requests.

Goal Reached Thanks to every supporter — we hit 100%!

phpseclib X.509 SSRF via Authority Information Access URL Validation

More from this source