Researchers release PoC exploit for critical Windows CryptoAPI bug (CVE-2022-34689)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0601 | ECC Certificate Spoofing in Microsoft Windows CryptoAPI (Crypt32.dll) CVE-2020-0601 (known as 'Curveball') is a spoofing flaw in Crypt32.dll, the Windows CryptoAPI component that validates Elliptic Curve Cryptography (ECC) certificates, which mishandles ECC certificate parameters when checking signatures. An attacker can trigger it by signing malicious content, most notably an executable, with a spoofed, attacker-controlled ECC certificate that Windows accepts as if it were issued by a trusted certificate authority; the attack vector is network-based but requires user interaction (CVSS 3.1: 8.1, AV:N/AC:L/PR:N/UI:R). Successful exploitation makes attacker-supplied malware appear to come from a legitimate, trusted software vendor, defeating code-signing trust prompts and signature-based trust decisions, with high impact on confidentiality and integrity. Affected systems are the Microsoft Windows 10 builds 1507 through 1909 and Windows Server versions 1803, 1903, 1909, 2016 and 2019 in the CISA data, with Go also listed as an affected vendor via its ECC certificate validation, effectively covering the mainstream Windows install base at the time. The flaw was discovered by the NSA and patched in the January 2020 Patch Tuesday; it is now CISA KEV-listed (added 2021-11-03, ransomware use unknown) with very high predicted exploitation risk (EPSS 89.4%, 100th percentile), and no public PoC is tracked in this data. Do: Apply Microsoft's January 2020 Patch Tuesday cumulative security updates for all affected Windows 10 and Windows Server builds, per CISA's required action (apply updates per vendor instructions). Prioritize user workstations and servers that validate signed binaries, Authenticode signatures, or TLS certificates, since exploitation hinges on a user or application trusting a spoofed ECC-signed artifact. If Go is deployed in your environment, update Go toolchains to a patched January 2020 or later release, as Go was also acknowledged as an affected vendor. | 8.1 | 89% | KEV |
| massover 1 billion Windows devices (essentially the entire Windows 10 install base on builds 1507-1909, plus Windows Server 2016/2019 deployments) | |
| CVE-2022-34689 | Windows CryptoAPI Spoofing Vulnerability Windows CryptoAPI Spoofing Vulnerability NVD description · AI analysis pending | 7.5 | 38% |
| — |
Full article451 words · extracted from helpnetsecurity.com · click to collapse
Akamai researchers have published a PoC exploit for a critical vulnerability (CVE-2022-34689) in Windows CryptoAPI, which validates public key certificates.
“An attacker could manipulate an existing public x.509 certificate to spoof their identity and perform actions such as authentication or code signing as the targeted certificate,” Microsoft said in October 2022, when they announced fixes for vulnerable Windows and Windows Server versions.
The vulnerability was actually patched in August 2022, but its existence only revealed two months later, likely to avoid alerting attackers before the security updates are widely implemented.
About CVE-2022-34689
“The root cause of the bug is the assumption that the certificate cache index key, which is MD5-based, is collision-free. Since 2009, MD5’s collision resistance is known to be broken,” researchers Tomer Peled and Yoni Rozenshein explained.
“The attack flow is twofold. The first phase requires taking a legitimate certificate, modifying it, and serving the modified version to the victim. The second phase involves creating a new certificate whose MD5 collides with the modified legitimate certificate, and using the new certificate to spoof the identity of the original certificate’s subject.”
But there is some good news: CVE-2022-34689 can’t be as widely exploited as CVE-2020-0601 (also called “CurveBall”), a similar Windows CryptoAPI spoofing vulnerability that has been leveraged by Chinese state-sponsored hackers and was, at one time, among the top 10 most exploited vulnerabilities from 2020.
CVE-2022-34689 exploitation
To exploit CVE-2022-34689, the first certificate, which is generated in a way that facilitates a chosen prefix collision attack and is correctly signed and verified, needs to be cached by the CryptoAPI, so that the second certificate (with the same MD5 thumbprint as the previous one) can be promptly trusted because Microsoft does not re-check cached certificates.
“The [CryptoAPI caching] mechanism is disabled by default. To enable it, the application developer needs to pass certain parameters to CertGetCertificateChain, the Windows API function that eventually leads to the vulnerable code,” the researchers explained.
They found some apps that use the CryptoAPI in such a way – old versions of Chrome (v48 and earlier) and Chromium-based applications – and they believe there are others.
Luckily, there are two prerequisites for a successful exploitation of CVE-2022-34689: the machine must run Windows and not have the patch released by Microsoft, and must run an app that uses the CryptoAPI caching mechanism.
The researchers advise admins to apply the latest security patch released by Microsoft on Windows servers and endpoints, and developers to switch to using other WinAPIs to check the validity of a certificate before using it.
Unsupported but still used Windows versions should get a patch, too, they noted, but I doubt that Microsoft will release them given the current limited exploitation scope.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/01/26/poc-exploit-cve-2022-34689/