Mutual Authentication Vulnerability in wolfSSL TLS 1.3 Implementation
CVE-2022-25640
7.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-25640?
In versions of wolfSSL prior to 5.2.0, an issue exists within the TLS 1.3 protocol where the server may fail to enforce mutual authentication. This allows a client to bypass the requirement to submit a certificate_verify message during the handshake, resulting in potential security risks by not presenting a client certificate. This lapse can facilitate unauthorized access or man-in-the-middle attacks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.