Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Any unpatched Windows application with CryptoAPI automatically validates spoofed certificates. An attacker can create a spoofed certificate by inserting unknown explicit curve parameters into an intermediate certificate. Clients that validate a spoofed certificate can be exposed to machine-in-the-middle (MITM) attacks.
Kill Chain
Risk Score
65
CryptoAPI, the Windows application programming interface for validating certificates, has a vulnerability that enables an attacker to spoof an intermediate certificate within a certificate chain. Specifically, the attacker generates a private key and ECC parameter set, which enables them to generate a public key that matches a cached certificate. Windows trusts the certificate based on a public key match, and does not fully validate the ECC parameters of all certificates saved in cache.
Install relevant patches for affected Windows servers, appliances, endpoints, and proxies that perform TLS validation
