CVE-2020-0601: high-severity vulnerability in Microsoft Windows
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
ssvc Actcvss 8.1epss 89%
from disclosure to weaponsame day
Published on NVDJan 14
1st PoCJan 14
CISA KEV+659d
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
Windows CryptoAPI fails to properly validate ECC certificates, allowing attackers to create fake certificates that appear legitimate. This lets malicious code appear to come from trusted sources, tricking users and systems into running it.
Technical detail
CryptoAPI (Crypt32.dll) improperly validates Elliptic Curve Cryptography certificates, enabling certificate spoofing attacks. An attacker can craft a malicious code-signing certificate that bypasses validation checks, allowing unsigned or maliciously-signed executables to appear as legitimately signed software from trusted publishers.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
Microsoft · WindowsMicrosoft · Windows 10 Version 1903 for 32-bit SystemsMicrosoft · Windows 10 Version 1903 for ARM64-based SystemsMicrosoft · Windows 10 Version 1903 for x64-based SystemsMicrosoft · Windows 10 Version 1909 for 32-bit SystemsMicrosoft · Windows 10 Version 1909 for ARM64-based SystemsMicrosoft · Windows 10 Version 1909 for x64-based SystemsMicrosoft · Windows ServerMicrosoft · Windows Server, version 1903 (Server Core installation)Microsoft · Windows Server, version 1909 (Server Core installation)public PoCs found — 52
exploitdbwww.exploit-db.com/exploits/47933unverifiedgithubgithub.com/ly4k/CurveBall★ 890githubgithub.com/kudelskisecurity/chainoffools★ 336githubgithub.com/gentilkiwi/curveball★ 76githubgithub.com/saleemrashid/badecparams★ 66githubgithub.com/0xxon/cve-2020-0601★ 35githubgithub.com/eastmountyxz/CVE-2020-0601-EXP★ 30githubgithub.com/ioncodes/Curveball★ 20githubgithub.com/RrUZi/Awesome-CVE-2020-0601★ 5githubgithub.com/0xxon/cve-2020-0601-plugin★ 5githubgithub.com/IIICTECH/-CVE-2020-0601-ECC---EXPLOIT★ 3githubgithub.com/nissan-sudo/CVE-2020-0601★ 2githubgithub.com/YoannDqr/CVE-2020-0601★ 2githubgithub.com/gremwell/cve-2020-0601_poc★ 2githubgithub.com/Hans-MartinHannibalLauridsen/CurveBall★ 1githubgithub.com/amlweems/gringotts★ 1githubgithub.com/yanghaoi/CVE-2020-0601★ 1githubgithub.com/Doug-Moody/Windows10_Cumulative_Updates_PowerShell★ 1githubgithub.com/talbeerysec/CurveBallDetection★ 1githubgithub.com/SherlockSec/CVE-2020-0601★ 1githubgithub.com/eastmountyxz/CVE-2018-20250-WinRAR★ 1githubgithub.com/BlueTeamSteve/CVE-2020-0601★ 1githubgithub.com/exploitblizzard/CVE-2020-0601-spoofkey★ 0githubgithub.com/0xxon/cve-2020-0601-utils★ 0githubgithub.com/thimelp/cve-2020-0601-Perl★ 0githubgithub.com/bsides-rijeka/meetup-2-curveball★ 0githubgithub.com/JoelBts/CVE-2020-0601_PoC★ 0githubgithub.com/okanulkr/CurveBall-CVE-2020-0601-PoC★ 0githubgithub.com/ShayNehmad/twoplustwo★ 0githubgithub.com/tyj956413282/curveball-plus★ 0githubgithub.com/JPurrier/CVE-2020-0601★ 0githubgithub.com/MarkusZehnle/CVE-2020-0601★ 0githubgithub.com/CrackerCat/CurveballCertTool★ 0githubgithub.com/Ash112121/CVE-2020-0601★ 0githubgithub.com/apodlosky/PoC_CurveBall★ 0githubgithub.com/dlee35/curveball_lua★ 0vulncheckvulncheck.com/xdb/496d3fc0b8d0unverifiedvulncheckvulncheck.com/xdb/77b9afed3e44unverifiedvulncheckvulncheck.com/xdb/f3005b474479unverifiedvulncheckvulncheck.com/xdb/2269fe47fe2funverifiedvulncheckvulncheck.com/xdb/cc5ed1f3625funverifiedvulncheckvulncheck.com/xdb/6abcb18100dcunverifiedvulncheckvulncheck.com/xdb/08bffaffbac2unverifiedcve_referencepacketstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlunverifiedvulncheckvulncheck.com/xdb/1ab56e688532unverifiedvulncheckvulncheck.com/xdb/da1e9b909080unverifiedvulncheckvulncheck.com/xdb/740afa3911a0unverifiedvulncheckvulncheck.com/xdb/0766cc1abe5dunverifiedvulncheckvulncheck.com/xdb/6bc84901f00aunverifiedcve_referencepacketstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlunverifiedvulncheckvulncheck.com/xdb/839b9e7e2e93unverifiedvulncheckvulncheck.com/xdb/09c5af32c1d7unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Windows
In the same product, most dangerous first.
References
http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlhttp://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601