PT-2022-5616 · Microsoft · Windows Cryptoapi+1

Published 2022-10-11 · Updated 2025-01-02 · CVE-2022-34689

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Windows CryptoAPI (affected versions not specified)

Description The issue is related to a spoofing vulnerability in the Windows CryptoAPI, which can be exploited to bypass authentication. This vulnerability allows an attacker to conduct spoofing attacks, potentially enabling them to manipulate certificates, including x.509 certificates, and exploit MD5 collisions. The vulnerability was discovered by the NSA and the UK's NCSC. It is estimated that a significant number of data center systems and applications based on Windows remain vulnerable. The vulnerability can be used to digitally sign malicious executable files, making them appear as if they come from trusted sources. A proof-of-concept exploit has been released, demonstrating the vulnerability's potential impact, including the ability to conduct MITM attacks and make a browser believe it is communicating with a legitimate HTTPS server when it is actually interacting with a malicious fake.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Spoofing

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2022-06982

CVE-2022-34689

Affected Products

Windows

Windows Cryptoapi

References · 19

• 🔥 https://github.com/akamai/akamai-security-research/tree/main/PoCs/CVE-2022-34689 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-34689 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34689 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06982 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34689 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-34689 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34689 · Security Note
• https://t.me/cybersecuritytechnologies/7629 · Telegram Post
• https://twitter.com/TalBeerySec/status/1690634465918205952 · Twitter Post
• https://t.me/cvenotify/106096 · Telegram Post
• https://twitter.com/angealbertini/status/1770221642058211460 · Twitter Post
• https://t.me/cibsecurity/51174 · Telegram Post
• https://t.me/cvenotify/64507 · Telegram Post
• https://t.me/true_secator/3989 · Telegram Post