CVE-2019-14222: Default Certificate in Alfresco Community

Alfresco Community 5.x and below ships by default with a set of known private certificates. Anyone who downloads and installs the Alfresco Community software on a local machine gets access to these files.

Once obtained, these private keys can be used to:

• Gain access to Solr (which uses x509 certificate authentication)
• Launch active MITM attacks using a trusted Alfresco Certificate
• Launch passive decryption attacks if Non-Ephemeral ciphers are used

NVD Disclosure:

The disclosure for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• That the Alfresco appliaction uses the default SSL/TLS certificates

Proof Of Concept:

More details and the exploitation process can be found in this PDF.