| शीर्षक | Cesanta Mongoose 7.20 Authorization Bypass |
|---|
| विवरण | secp384r1 (P-384) Certificate Verification Bypass in Mongoose v7.20 mTLS
mg_tls_verify_cert_signature() returns 1 without checking when the issuer CA has a P-384 public key (96 bytes). This means ANY such client certificate is accepted by an mTLS server,
https://github.com/cesanta/mongoose/blob/master/mongoose.c#L14080
### Impact
mTLS based authentication bypass.
### Disclosure
Vendor contacted Feb 26 and CONFIRMED the vulnerability.
### Exploit
Due to the nature of the library, I could not target a single device or hardware configuration, so I had to create one myself via qemu.
[redacted] |
|---|
| उपयोगकर्ता | the_evilsocket (UID 96063) |
|---|
| सबमिशन | 02/03/2026 05:41 PM (7 महीनों पहले) |
|---|
| संयम | 02/04/2026 09:43 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 354827 [Cesanta Mongoose तक 7.20 P-384 Public Key mongoose.c mg_tls_verify_cert_signature अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|