Description
Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise server integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nationalsecurityagency | ghidra | < 12.1 | 12.1 |
References
- GitHub Security Advisory (GHSA-5wxq-7qpv-65p2) vendor-advisory
- Patch Commit (1) patch
- Patch Commit (2) patch
- https://www.vulncheck.com/advisories/ghidra-authentication-bypass-via-null-signature-in-pkiauthenticationmodule third-party-advisory