🚀 أصبحت CloudSek أول شركة للأمن السيبراني من أصل هندي تتلقى استثمارات منها ولاية أمريكية صندوق
اقرأ المزيد
Advisory |
Vulnerability Intelligence |
Type |
Authentication Bypass |
CVE |
CVE-2020-28052 |
Application |
Bouncy Castle API 1.65/1.66 |
Affected Platforms |
Java/C# .NET applications |
Vulnerable Code[/caption]
Once the attacker bypasses the password check, they don't need a byte-for-byte match with the stored hash value, which enables authentication bypass. Attackers use brute force attacks to crack passwords until the bypass is triggered.
Here’s a list of major applications that use BouncyCastle (Versions that are not verified):
- Google Messages
- Netflix
- Wish App
- Samsung Email
- Xiomi File Manager
- PhonePe
- Amazon Alexa
Impact
- Applications using Bouncy Castle 1.65 or 1.66 are vulnerable to authentication bypass vulnerability.
- Attackers can bypass the authentication mechanism implemented by the affected Bouncy Castle library in the application.
- Authentication bypass can lead to unauthorized information disclosure
- Bcrypt hashing based authentications are widely used in web applications and APIs, this vulnerability compromises the security of such systems if not checked.
