CVE-2023-5594: Eset Endpoint Antivirus Vulnerability

CVE-2023-5594 Overview

CVE-2023-5594 is a certificate validation bypass vulnerability affecting ESET security products' secure traffic scanning feature. The vulnerability stems from improper validation of the server's certificate chain, where intermediate certificates signed using weak cryptographic algorithms (MD5 or SHA1) are incorrectly trusted. This flaw enables attackers to potentially intercept and manipulate encrypted traffic that should be protected by TLS/SSL.

Critical Impact

Attackers can exploit this vulnerability to perform man-in-the-middle attacks by using certificates signed with weak algorithms that the ESET products improperly trust, allowing interception of sensitive encrypted communications across affected networks.

Affected Products

• ESET Endpoint Antivirus (Windows and Linux)
• ESET Endpoint Security (Windows)
• ESET File Security (Azure)
• ESET Internet Security
• ESET Mail Security (Domino and Exchange Server)
• ESET NOD32 Antivirus
• ESET Security (SharePoint Server and Ultimate)
• ESET Server Security (Windows Server and Linux)
• ESET Smart Security Premium

Discovery Timeline

• 2023-12-21 - CVE-2023-5594 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-5594

Vulnerability Analysis

This vulnerability is classified under CWE-295 (Improper Certificate Validation), a critical category of cryptographic vulnerabilities that undermines the trust model of TLS/SSL communications. The secure traffic scanning feature in ESET products performs SSL/TLS inspection to scan encrypted traffic for threats. During this process, the software validates the certificate chain of servers to ensure communication integrity.

The flaw occurs in the certificate chain validation logic where intermediate certificates signed using deprecated hash algorithms—specifically MD5 and SHA1—are incorrectly accepted as trusted. Both MD5 and SHA1 have been considered cryptographically broken for certificate signing purposes for years, with MD5 collision attacks demonstrated as early as 2008 and SHA1 practically broken by 2017.

When ESET products perform secure traffic scanning, they intercept TLS connections and validate the server's certificate chain. The vulnerable validation logic fails to properly reject intermediate certificates that use these weak signature algorithms, creating a trust anchor that should not exist.

Root Cause

The root cause lies in the improper implementation of certificate chain validation within ESET's secure traffic scanning module. The validation logic does not adequately check the signature algorithms used for intermediate certificates in the chain of trust. Modern certificate validation should reject any certificate in the chain signed with MD5 or SHA1 due to their cryptographic weaknesses that allow collision attacks.

The secure traffic scanning feature essentially acts as a TLS proxy, intercepting encrypted communications to inspect traffic for malware. This proxy functionality requires rigorous certificate validation to maintain security guarantees. The failure to reject weak signature algorithms in intermediate certificates breaks this security model.

Attack Vector

An attacker can exploit this vulnerability through a network-based attack without requiring any user interaction or special privileges. The attack scenario involves:

1. The attacker positions themselves in a man-in-the-middle position between the victim and a target server
2. The attacker presents a malicious certificate chain containing an intermediate certificate signed with MD5 or SHA1
3. ESET's secure traffic scanning feature incorrectly validates this certificate chain as trusted
4. The attacker can then intercept, decrypt, and potentially modify encrypted traffic

The attack is particularly concerning because it subverts the very security feature designed to protect users—the secure traffic scanning functionality intended to inspect encrypted traffic for threats instead becomes the enabler of the attack by trusting improperly signed certificates.

Detection Methods for CVE-2023-5594

Indicators of Compromise

• Unexpected certificate warnings or acceptance of certificates with MD5 or SHA1 signatures in the chain
• Network traffic containing intermediate certificates signed with deprecated algorithms
• TLS inspection logs showing acceptance of weak signature algorithms in certificate chains
• Anomalous certificate chain structures in ESET product logs

Detection Strategies

• Monitor ESET product logs for certificate validation events, particularly focusing on signature algorithm details
• Implement network monitoring to detect certificates signed with MD5 or SHA1 in active TLS sessions
• Deploy certificate transparency monitoring to identify potentially malicious certificates that could be used in exploitation
• Review ESET management console for any unusual certificate acceptance behavior

Monitoring Recommendations

• Enable detailed logging in ESET products to capture certificate chain validation events
• Implement network security monitoring solutions that can inspect TLS handshakes for weak signature algorithms
• Configure alerts for any detection of MD5 or SHA1 signed certificates in enterprise network traffic
• Regularly audit ESET product configurations and version status to ensure patches are applied

How to Mitigate CVE-2023-5594

Immediate Actions Required

• Update all affected ESET products to the latest patched versions immediately
• Review the ESET Security Advisory for specific version requirements
• Audit network traffic for any signs of man-in-the-middle attacks exploiting this vulnerability
• Consider temporarily disabling secure traffic scanning if immediate patching is not possible

Patch Information

ESET has released security updates to address this vulnerability. Administrators should consult the ESET Security Advisory for detailed patch information and affected version numbers. The fix ensures that intermediate certificates signed with MD5 or SHA1 algorithms are no longer incorrectly trusted during certificate chain validation.

Organizations using ESET Remote Administrator or ESET PROTECT for centralized management should deploy updates across all managed endpoints. Priority should be given to systems handling sensitive communications or operating in high-risk network environments.

Workarounds

• Disable the secure traffic scanning feature until patches can be applied, accepting the trade-off of reduced visibility into encrypted traffic
• Implement network-level certificate validation controls to reject certificates signed with weak algorithms before they reach endpoints
• Deploy additional network security monitoring to detect potential exploitation attempts
• Consider implementing certificate pinning for critical internal applications to reduce the attack surface

# ESET configuration - Disable SSL/TLS protocol filtering temporarily
# Access ESET GUI > Setup > Network protection > SSL/TLS
# Set "Enable SSL/TLS protocol filtering" to disabled until patched
# Note: This reduces protection capabilities - apply patches as soon as possible