{"id":123627,"date":"2025-04-22T09:05:07","date_gmt":"2025-04-22T07:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena"},"modified":"2025-04-22T09:05:07","modified_gmt":"2025-04-22T07:05:07","slug":"uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans l'autorit\u00e9 de certification SSL.com, permettant d'obtenir un certificat pour un domaine \u00e9tranger","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le syst\u00e8me de v\u00e9rification de propri\u00e9t\u00e9 de domaine de l'autorit\u00e9 de certification SSL.com, permettant d'obtenir un certificat TLS pour n'importe quel domaine ayant fourni un email \u00e0 l'attaquant. Pour obtenir le certificat TLS, il suffisait d\u2019avoir acc\u00e8s \u00e0 l'email du domaine cibl\u00e9. Par exemple, cette vuln\u00e9rabilit\u00e9 permettait d'obtenir un certificat TLS pour des domaines utilis\u00e9s dans des services email publics tels que gmail.com, yandex.ru, yahoo.com, outlook.com et icloud.com. <\/p>\n

La vuln\u00e9rabilit\u00e9 offrait \u00e9galement la possibilit\u00e9 aux attaquants de mener des attaques cibl\u00e9es contre des employ\u00e9s de soci\u00e9t\u00e9s renomm\u00e9es et des participants \u00e0 de grands projets pour acc\u00e9der \u00e0 leurs emails et obtenir des certificats TLS pour des domaines connus. domaines<\/a>. Par exemple, compromettre un employ\u00e9 de Google ayant l'email name@google.com permettait d'obtenir un certificat pour le domaine<\/a> google.com. <\/p>\n

La vuln\u00e9rabilit\u00e9 \u00e9tait due \u00e0 une erreur dans la mise en \u0153uvre du syst\u00e8me de v\u00e9rification de propri\u00e9t\u00e9 de domaine par e-mail. Pour obtenir la confirmation par email, il est n\u00e9cessaire d'ajouter un enregistrement DNS TXT «_validation-contactemail» dans la zone DNS du domaine pour lequel le certificat est demand\u00e9. Par exemple, «_validation-contactemail.test.com DNS TXT name@example.com». Apr\u00e8s l'initiation de la v\u00e9rification du domaine, un code de confirmation sera envoy\u00e9 \u00e0 l'adresse e-mail name@example.com, dont la saisie confirme la propri\u00e9t\u00e9 du domaine «test.com» et permet d'obtenir un certificat TLS pour «test.com». <\/p>\n

L'essence de la vuln\u00e9rabilit\u00e9 r\u00e9side dans le fait qu'en plus du domaine «test.com» pour lequel le certificat a \u00e9t\u00e9 demand\u00e9, le crit\u00e8re de confirmation de propri\u00e9t\u00e9 \u00e9tait \u00e9galement d\u00e9fini pour le domaine «example.com», utilis\u00e9 dans l'e-mail. Le chercheur ayant d\u00e9tect\u00e9 le probl\u00e8me a d\u00e9montr\u00e9 l'obtention d'un certificat TLS fonctionnel pour le domaine aliyun.com, utilis\u00e9 dans le service de webmail de l'entreprise chinoise Alibaba. Au cours d'une attaque de test, le chercheur a enregistr\u00e9 un domaine de v\u00e9rification «d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com» dans le service «dcv-inspector.com» et a demand\u00e9 un certificat TLS pour celui-ci en ajoutant l'enregistrement DNS : _validation-contactemail.d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com DNS TXT myusername@aliyun.com <\/p>\n

Apr\u00e8s cela, il a demand\u00e9 sur le site SSL.com un certificat TLS pour le domaine d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com et a choisi la confirmation par email. L'autorit\u00e9 de certification SSL.com a envoy\u00e9 un code de v\u00e9rification \u00e0 myusername@aliyun.com et apr\u00e8s la saisie de ce code, elle a ajout\u00e9 \u00e0 la liste des domaines v\u00e9rifi\u00e9s non seulement «d2b4eee07de5efcb8598f0586cbf2690.test.dcv-inspector.com», mais aussi «aliyun.com». Par la suite, le chercheur a r\u00e9ussi \u00e0 obtenir un certificat TLS pour le domaine «aliyun.com», dont la propri\u00e9t\u00e9 avait \u00e9t\u00e9 confirm\u00e9e. <\/p>\n

L'autorit\u00e9 de certification SSL.com a r\u00e9solu le probl\u00e8me et a d\u00e9couvert 11 certificats pour lesquels une m\u00e9thode de v\u00e9rification vuln\u00e9rable utilisant un domaine externe par email avait \u00e9t\u00e9 utilis\u00e9e. Il semble qu'il n'y ait pas de signes d'activit\u00e9 malveillante dans les cas identifi\u00e9s et parmi les 11, un seul certificat, obtenu par le chercheur pour le site aliyun.com, a \u00e9t\u00e9 r\u00e9voqu\u00e9 pour le moment. Les autres certificats impliquaient les domaines medinet.ca, help.gurusoft.com.sg, banners.betvictor.com, production-boomi.3day.com, kisales.com et medc.kisales.com. SSL.com pr\u00e9voit de publier un rapport sur l'incident d'ici le 2 mai.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a email \u0441 \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 email-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a gmail.com, yandex.ru, yahoo.com, outlook.com \u0438 icloud.com. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0434\u0430\u0432\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123627","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans l'autorit\u00e9 de certification SSL.com, permettant d'obtenir un certificat pour un domaine tiers | ProHoster","description":"Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le syst\u00e8me de v\u00e9rification de possession de domaine de l'autorit\u00e9 de certification SSL.com, permettant d'obtenir un certificat TLS pour n'importe quel domaine ayant fourni un email \u00e0 l'attaquant.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u0447\u0443\u0436\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u0412 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u043c \u0446\u0435\u043d\u0442\u0440\u0435 SSL.com \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432\u0448\u0435\u0433\u043e email \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-udostoveryayushhem-czentre-ssl-com-pozvolyavshaya-poluchit-sertifikat-dlya-chuzhogo-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-22T07:05:07+00:00","article:modified_time":"2025-04-22T07:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123627","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:16:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:22:22","updated":"2026-02-11 11:16:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=123627"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123627\/revisions"}],"predecessor-version":[{"id":160581,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123627\/revisions\/160581"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=123627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=123627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=123627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}