Other nomination

mTLS: When certificate authentication is done wrong

Michael Stepankin · The GitHub Blog · 17 August 2023

Implementation flaws in mutual-TLS client authentication: servers that scan the whole certificate chain instead of only the first entry let an attacker impersonate another user with a self-signed certificate (Keycloak); certificate stores build LDAP filters from the unverified Subject field (Bouncy Castle); and revocation URLs read from certificate extensions give SSRF and leak the server's LDAP credentials (Apereo CAS).

Record

Researcher

Michael Stepankin

Published by

The GitHub Blog

Date

17 August 2023

In the archive

• Nominated for the 2023 Top 10 Web Hacking Techniques

Related sources

• Earlier certificate-revocation vulnerability
• Talk recording
• Talk recording

Tags

• auth-bypass
• injection
• ssrf
• tls
• sso
• java
• info-leak
• reverse-proxy
• cve
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Michael Stepankin, first published at the original source. Preserved copies are kept so the citation survives its host.