CVE-2022-34831 Explained : Impact and Mitigation

This article provides detailed information about CVE-2022-34831, a vulnerability discovered in Keyfactor PrimeKey EJBCA before version 7.9.0 that could lead to the issuance of certificates with unvalidated identifiers.

Understanding CVE-2022-34831

CVE-2022-34831 is related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization in Keyfactor PrimeKey EJBCA.

What is CVE-2022-34831?

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, where a non-compliant client could include additional dnsNames in the CSR sent to the finalize endpoint, causing EJBCA to issue a certificate including identifiers that were not validated.

The Impact of CVE-2022-34831

This vulnerability allows for the issuance of certificates with unvalidated identifiers, potentially undermining the security of the certificate issuance process.

Technical Details of CVE-2022-34831

The following provides technical details of the CVE-2022-34831 vulnerability:

Vulnerability Description

During the ACME enrollment process, an order is submitted with dnsNames that are validated, but additional dnsNames can be included in the CSR, resulting in the issuance of certificates with unvalidated identifiers.

Affected Systems and Versions

Keyfactor PrimeKey EJBCA versions before 7.9.0 are affected by this vulnerability.

Exploitation Mechanism

By exploiting this vulnerability, a non-compliant client can manipulate the CSR to include unvalidated identifiers in the certificate.

Mitigation and Prevention

To mitigate the risks associated with CVE-2022-34831, the following steps can be taken:

Immediate Steps to Take

Update Keyfactor PrimeKey EJBCA to version 7.9.0 or newer.
Ensure that CSR submissions align with validated identifiers.

Long-Term Security Practices

Regularly update and patch EJBCA to prevent known vulnerabilities.
Conduct thorough validation of DNS identifiers during the certificate issuance process.

Patching and Updates

Install all security patches and updates provided by Keyfactor PrimeKey to address CVE-2022-34831.