CVE-2023-6058

Executive Summary

CVE-2023-6058 describes a critical security flaw in Bitdefender Safepay, a secure browser component of Bitdefender security products. The vulnerability lies in the handling of HTTPS connections: when Safepay blocks a connection due to an untrusted server certificate, it allows the user to add the site to an exception list. Once added, the product trusts the certificate for all subsequent HTTPS scans, including self-signed certificates. This enables an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering secure communications. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is significant as it undermines the trust model of HTTPS. No public exploit code or patch details are available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – user must add site to exceptions
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Threat Level: High – MITM attacks can lead to credential theft, data interception, and session hijacking.

Deep Dive & Mechanics

The vulnerability originates from a flawed exception-handling mechanism in Bitdefender Safepay. When a user visits an HTTPS site with an untrusted certificate (e.g., self-signed, expired, or mismatched), Safepay blocks the connection and presents a warning. The user is given the option to add the site to an exception list, which is intended to bypass the warning for legitimate internal or testing sites. However, the implementation fails to re-validate the certificate after the exception is added. Once the site is in the exception list, Safepay trusts any certificate presented by that domain, including attacker-controlled self-signed certificates. This allows an attacker who can intercept the traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) to present a self-signed certificate and have it accepted by Safepay, enabling full MITM capabilities.

The root cause is a lack of proper certificate pinning or validation after exception addition. The exception list should only bypass the warning for the specific certificate that was originally presented, not for any certificate from that domain.

Vulnerable vs. Patched Code

No official patch or code diff is available. However, the vulnerable behavior can be described:

• Vulnerable: When a user adds a site to exceptions, Safepay stores the domain name and trusts any certificate for that domain in future scans.
• Patched (Expected): The exception list should store the certificate fingerprint (hash) along with the domain. Future connections to that domain should only be trusted if the certificate matches the stored fingerprint. Alternatively, the exception mechanism should be removed or require explicit re-validation.

Exploitation & Lab Setup

Red Team

1. Setup: Attacker controls a network position (e.g., rogue access point, ARP spoofing on LAN).
2. Intercept: Use a tool like mitmproxy or Bettercap to intercept HTTPS traffic from the victim.
3. Certificate: Generate a self-signed certificate for the target domain (e.g., bank.example.com).
4. Trigger: Victim visits bank.example.com via Safepay. Safepay blocks the connection due to untrusted certificate.
5. Social Engineering: Victim is prompted to add the site to exceptions. Attacker may use phishing or pretexting to convince the victim to do so.
6. Exploit: Once added, Safepay trusts the self-signed certificate. Attacker can now decrypt, view, and modify all HTTPS traffic to that domain.

Example mitmproxy command:

mitmproxy --mode transparent --listen-port 8080 --set block_global=false

Blue Team

1. Detection: Monitor for unusual certificate warnings in Safepay logs. Look for repeated addition of exception entries.
2. Prevention: Disable the exception feature via group policy or registry if possible. Enforce strict certificate validation.
3. Response: If an exception is added, verify the certificate fingerprint manually. Use network monitoring to detect MITM indicators (e.g., unexpected certificate changes, ARP spoofing).
4. Hunting: Search for logs indicating exception additions and correlate with network anomalies.

Indicators of Compromise (IOCs)

• Network: Unexpected self-signed certificates for known domains.
• Endpoint: Safepay exception list entries for sensitive domains.
• Logs: Safepay logs showing "exception added" events for HTTPS sites.
• Behavior: User reports of repeated certificate warnings followed by exception additions.

Detection Engineering

YARA Rule

rule CVE_2023_6058_Safepay_Exception {
    meta:
        description = "Detects Bitdefender Safepay exception list entries indicating potential MITM exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6058"
    strings:
        $s1 = "exception" nocase
        $s2 = "safepay" nocase
        $s3 = "certificate" nocase
    condition:
        all of them
}

Sigma Rule

title: Bitdefender Safepay Exception Addition
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects when a user adds an HTTPS site to Safepay exceptions, which may indicate MITM exploitation (CVE-2023-6058)
author: Valters IT
date: 2025-04-10
logsource:
    product: bitdefender
    service: safepay
detection:
    selection:
        EventID: 1001  # Hypothetical event ID for exception addition
        Message: "*exception*added*"
    condition: selection
falsepositives:
    - Legitimate internal site exceptions
level: medium

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2023-6058 - Potential MITM via Self-Signed Certificate in Safepay"; flow:to_server; tls.cert_subject; content:"CN="; pcre:"/CN=[a-zA-Z0-9.-]+/"; tls.cert_issuer; content:"CN="; pcre:"/CN=[a-zA-Z0-9.-]+/"; tls.cert_self_signed; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the exception feature in Safepay if possible. Use group policies to enforce strict certificate validation.
• Workaround: Educate users not to add sites to exceptions unless absolutely necessary and only after verifying the certificate fingerprint.
• Patch: Await an official patch from Bitdefender that implements certificate pinning or removes the exception feature.
• Long-term: Implement certificate transparency and public key pinning (HPKP) where possible. Use network monitoring to detect MITM attacks.

Valters IT