CVE-2015-1793
MEDIUMOracle Supply Chain Products Suite < 2.0.0.6 - Security Feature Bypass
Title source: ruleExploitation Summary
EIP tracks 2 public exploits for CVE-2015-1793.
PoCs published by Ramon de C Valle, David Benjamin, Adam Langley, Ramon de C Valle, including Metasploit module auxiliary/server/openssl_altchainsforgery_mitm_proxy.
AI-analyzed exploit summary This exploit leverages CVE-2015-1793, a vulnerability in OpenSSL's certificate verification process, to perform a man-in-the-middle attack by generating a fake certificate chain. It acts as a proxy to intercept and relay SSL/TLS traffic between a client and server.
Description
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Exploits (2)
This exploit leverages CVE-2015-1793, a vulnerability in OpenSSL's certificate verification process, to perform a man-in-the-middle attack by generating a fake certificate chain. It acts as a proxy to intercept and relay SSL/TLS traffic between a client and server.
This Metasploit module exploits CVE-2015-1793 in OpenSSL by forging a certificate chain to bypass client-side validation, enabling a MITM attack. It proxies SSL/TLS traffic between client and server while impersonating the server with a crafted certificate.
References (31)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N