Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

ExploitDBExploitDB exploitStubEDB-10071

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a private key, a certificate request, and a signed certificate for a subject with a null character (CN=*\x00thoughtcrime.noisebridge.net). It describes the NSS null-character CA certificate validation bypass vulnerability but provides no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a text file containing a description of CVE-2009-3555, a private RSA key, a certificate request, and a signed certificate. The content demonstrates a known SSL/TLS renegotiation vulnerability (NULL character in CN) but contains no executable code, concealed payload, or instructions for the reviewer. No backdoor or deceptive behavior is observed.

ClassificationStub
Model confidence95%
AuthenticationNot required
Languagestext
Target softwareMozilla NSS
Attack typesman-in-the-middleimpersonation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a text file containing cryptographic material (private key, certificate request, signed certificate) and a vulnerability description. It lacks any executable code, scripts, or instructions to perform the attack or scan for the vulnerability. It is a placeholder demonstrating the certificate material but is not a functional exploit or scanner.

exploits/multiple/remote/10071.txt:1-155

Requirements

  • Attacker must be able to perform a man-in-the-middle attack.exploits/multiple/remote/10071.txt:7
  • Target must use a vulnerable version of Mozilla NSS that fails to properly validate null characters in CA certificates.exploits/multiple/remote/10071.txt:3

Observed behavior

  • The file contains a private RSA key and a certificate request with a subject common name containing a null byte (\x00) to exploit NSS's improper domain name validation.exploits/multiple/remote/10071.txt:66exploits/multiple/remote/10071.txt:92-106exploits/multiple/remote/10071.txt:107-119
  • The file includes a signed certificate issued by ipsCA for the crafted subject, which could be used to impersonate a trusted server if the CA's root is trusted.exploits/multiple/remote/10071.txt:120-155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Private Key
RSA 1024-bit private key (lines 92-106)The file includes a full RSA private key in PEM format, which is part of the proof-of-concept for the certificate validation bypass. It is not hidden or obfuscated and is presented as demonstration material.exploits/multiple/remote/10071.txt:92-106
Certificate
X.509 certificate with CN=*\x00thoughtcrime.noisebridge.net (lines 120-155)The certificate contains a NULL byte in the Common Name, illustrating the CVE-2009-3555 vulnerability. This is the core of the PoC and is not a concealed payload.exploits/multiple/remote/10071.txt:120-155
Review boundaries

What the analysis did not establish

  • The artifact is a static text file with no executable code; it cannot be classified as an exploit or scanner.
  • The analysis is based solely on the provided text; no external tools or libraries were inspected.
  • Only the supplied text file was reviewed; no external resources or referenced URLs were fetched or analyzed.
  • The file contains a private key and certificate, but no active or concealed behavior is present in the text itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1