CVE-2022-0778 PoC — OpenSSL 安全漏洞

Source

https://github.com/0xUhaw/CVE-2022-0778

Associated Vulnerability

Title:OpenSSL 安全漏洞 (CVE-2022-0778)
Description:OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL1.0.2 版本、1.1.1版本和3.0版本存在安全漏洞，该漏洞源于计算模平方根的BN_mod_sqrt() 函数存在错误，可能导致对于非素数模数无线循环。攻击者可以发送特殊的函数参数值利用该漏洞导致应用在解析证书的过程中触发拒绝服务。

Description

Proof of concept for CVE-2022-0778 in P12 and PEM format

Readme

# CVE-2022-0778

### Description
We refer to the concept of [drago-96](https://github.com/drago-96/CVE-2022-0778) and then rewrite a PoC based on the P12 and PEM format. You can use it to verify the CVE-2022-0778 vulns, i.e., a dangerous SSL certificate (without any private password, leave it empty). If the device is affected, it may cause the CPU of the process to be 100% or reboot.


### Credits
- https://github.com/drago-96/CVE-2022-0778
- https://twitter.com/taviso
- https://github.com/wllm-rbnt/asn1template

### Release Date
> 4/21/2022

### Authors
- [YU-HSIANG HUANG](https://www.facebook.com/Huang.YuHsiang.Phone/)
- YUNG-HAO TSENG

File Snapshot


 [4.0K]  /data/pocs/0de288c960c4dc665533335c4342a405e453a96d
├── [2.0K]  CVE-2022-0778.p12
├── [ 732]  CVE-2022-0778.pem
└── [ 647]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!