CVE-2023-52160: Medium severity Debian Debian Linux vulnerability
In wpasupplicant, a flaw was discovered in the implementation of PEAP, which allows an attacker to skip the second phase of authentication when the target device has not been properly configured to verify the authentication server. Note that PEAP is the most common authentication method for Enterprise networks. By skipping Phase-2 authentication, it’s much easier for an attacker to create a rogue clone of a trusted WiFi network and trick the victim into connecting, all without knowing their password.
Typical Attack Prerequisites: - The attacker needs to know the SSID of the target Enterprise WPA2/3 network - The attacker must be within range of their victim, who can be located anywhere, i.e. they don’t need to be in range of the network being impersonated during the attack - wpasupplicant must be configured to not verify the authentication server’s TLS certificate
It is trivial to harvest SSIDs from around office buildings or to advertise popular Enterprise network names such as eduroam, Vodafone Homespot, TelenetWiFree or Unitymedia WifiSpot for example, and simply wait for an unsuspecting victim to connect. The misconfiguration of wpasupplicant is unfortunately a known issue on many systems. Proper configuration is a manual process, whose confusing and tedious nature prompts many users to skip it.
References: https://www.top10vpn.com/research/wifi-vulnerabilities/ https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baff
Other sources
The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication and an eappeapdecrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
— Microsoft
The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52160?
The severity of CVE-2023-52160 is considered high due to the potential for attackers to bypass PEAP authentication when misconfigurations are present.
How do I fix CVE-2023-52160?
To fix CVE-2023-52160, ensure that all devices are properly configured to verify the authentication server when using PEAP.
Which software is affected by CVE-2023-52160?
CVE-2023-52160 affects wpa_supplicant versions up to and including 2.10 on specific distributions like Debian 10.0, Fedora 38 and 39, and Red Hat Enterprise Linux 8.0 and 9.0.
Can CVE-2023-52160 be exploited remotely?
Yes, CVE-2023-52160 can potentially be exploited remotely by attackers targeting non-verified PEAP authentication configurations.
What authentication method does CVE-2023-52160 affect?
CVE-2023-52160 affects the Protected Extensible Authentication Protocol (PEAP), which is widely used for enterprise wireless network authentication.