4 matches found
CVE-2022-21449
CVE-2022-21449 repo showcasing generation of a base64 signature for applications that are vulnerable to "psychic signatures in java", implemented in a nodejs environment 😅 Before running make sure to install the modified fork of elliptic from https://github.com/davwwwx/elliptic root@kitploit: $ n...
CVE-2022-21449-TLS-PoC
CVE-2022-21449-TLS-PoC CVE-2022-21449(在 Neil Madden 的漏洞分析文章中也被称为“Psychic Signatures”)的概念验证,演示了如何将其用于易受攻击的客户端和恶意 TLS 服务器。 恶意服务器展示了一个截至 2022-04-20 对 www.google.com 有效的证书链,该证书链带有 ECDSA 公钥(secp256r1)。但是,crypto/ecdsa 包已被修改为提供 r = s = 0 的无效签名。易受攻击的客户端接受此无效签名,从而使 TLS 握手能够继续进行。 除了在构建和探索过程中移除的 test.go...
psychic-signatures
CVE-2022-21449: Psychic Signatures in Java...
Check Point Response to CVE-2022-21449 - Java "Psychic Signatures"
Symptoms - On April 20, 2022, security researcher Neil Madden published a blog post in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or "Psychic Signatures". This security vulnerability originates in an incorrect implementation of the ECDSA signature...