CVE-2022-21449

CVE-2022-21449 repo showcasing generation of a base64 signature for applications that are vulnerable to "psychic signatures in java", implemented in a nodejs environment 😅 Before running make sure to install the modified fork of elliptic from https://github.com/davwwwx/elliptic root@kitploit: $ n...

CVE-2022-21449-TLS-PoC

CVE-2022-21449-TLS-PoC CVE-2022-21449（在 Neil Madden 的漏洞分析文章中也被称为“Psychic Signatures”）的概念验证，演示了如何将其用于易受攻击的客户端和恶意 TLS 服务器。 恶意服务器展示了一个截至 2022-04-20 对 www.google.com 有效的证书链，该证书链带有 ECDSA 公钥（secp256r1）。但是，crypto/ecdsa 包已被修改为提供 r = s = 0 的无效签名。易受攻击的客户端接受此无效签名，从而使 TLS 握手能够继续进行。 除了在构建和探索过程中移除的 test.go...

psychic-signatures

CVE-2022-21449: Psychic Signatures in Java...

Check Point Response to CVE-2022-21449 - Java "Psychic Signatures"

Symptoms - On April 20, 2022, security researcher Neil Madden published a blog post in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or "Psychic Signatures". This security vulnerability originates in an incorrect implementation of the ECDSA signature...