{"uuid": "ca9ba972-41ec-4e55-b449-31f4eee81350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34689", "type": "seen", "source": "https://t.me/hacking_Attack/87290", "content": "Black Hat Ethical Hacking\nWindows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit Released\n\nWindows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedPost Views: 49 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Akamai researchers have released proof of concept exploit code for a critical Windows CryptoAPI vulnerability, which was discovered by the NSA and U.K.\u2019s NCSC and allows for MD5-collision certificate spoofing. Tracked as CVE-2022-34689, this security flaw was addressed with security updates in August 2022, but was not made public by Microsoft until October.\n\nThe vulnerability allows unauthenticated attackers to manipulate existing public x.509 certificates to spoof their identity and perform actions such as authentication or code signing as the targeted certificate. \nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Exploiting the vulnerabilityThe Akamai researchers have also shared an OSQuery to help defenders detect CryptoAPI library versions vulnerable to attacks. \nThey have found that older versions of Chrome (v48 and earlier) and Chromium-based applications can be exploited, but believe that there are more vulnerable targets in the wild.\n\nThe vulnerability can impact the validation of trust for HTTPS connections and signed executable code, files, or emails and can also provide attackers with the ability to perform man-in-the-middle attacks and decrypt confidential information. \nTrending: A primer on OS Command Injection Attacks\nTrending: Recon Tool: Shotlooter Update your Windows serversThe researchers advise to patch your Windows servers and endpoints with the latest security patch released by Microsoft.\nTrending: PoC exploits released for critical bugs in popular WordPress plugins Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-5-3-300x150.png Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit ChainJanuary 24, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-4-3-300x150.png OneNote Attachments: The Next Frontier in Malware DistributionJanuary 23, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-1-300x150.png T-Mobile hacked to steal data of 37 million accounts in API data breachJanuary 20, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit Released first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:05.679174Z"}