CVE-2022-34831 Business logic in n/a

Critical 9.8 Published 14 Sep 2022 Updated 3 Aug 2024

Attackers can bypass ACME validation to issue certificates with unverified DNS names, undermining PKI trust integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-34831?

CVE-2022-34831 is a critical vulnerability in n/a, published on 14 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.

Weakness: CWE-295

Which versions are affected by CVE-2022-34831?

1 open source package ship an affected version, including ejbca. It affects 1 product.

Package	Affected	Fixed in
`ejbca` Bitnami	All versions	`7.9.0`

Products include Primekey Ejbca.

How do I fix CVE-2022-34831?

Upgrade ejbca to 7.9.0 or later.

Is CVE-2022-34831 being exploited?

There is no known exploitation of CVE-2022-34831 in the wild and no public exploit code.

Sources

Also known as BIT-ejbca-2022-34831, GHSA-w496-q2jp-3qx5.