Executive Summary

The vulnerability exists in the epa4all-client, a Java client used in the Telematik Infrastruktur for ePA 3.0. Before version 1.2.2, an attacker who can perform a man-in-the-middle (MITM) attack on the TLS connection between the client and the Identity Provider (IDP) within the TI network can replace the legitimate discovery document with a forged one.

This forged discovery document redirects certain URIs (uri_puk_idp_enc and uri_puk_idp_sig) to attacker-controlled URLs. As a result, the client encrypts the signed challenge response using the attacker's encryption key and sends it to the attacker's authentication endpoint, allowing the attacker to capture signed authentication material.

This vulnerability was fixed in version 1.2.2 of the epa4all-client.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the compromise of signed authentication material by an attacker who can intercept and manipulate the TLS connection within the TI network.

An attacker could capture sensitive authentication data, potentially allowing unauthorized access or impersonation within the system that uses the epa4all-client.

Because the attacker can obtain signed challenge responses, this could undermine the security and trustworthiness of the authentication process.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the epa4all-client to version 1.2.2 or later, as this version contains the fix for the issue.

Useful 0 Not Useful 0