ID10 | ESC1

A certificate template is vulnerable to ESC1 when it permits specifying a subjectAltName (SAN) when requesting a certificate.

References:

• The Hacker Recipes (Certificate templates)

• HTTP418 INFOSEC (ESC1 - Misconfigured Templates)

Table of availables actions, states, and targets

Vulnerability ID	Trigger available	Default state	Default target
10 | ESC1	No	Absent	dc01

Launch

Enable

# Current directory: ansible
ansible-playbook -i inventory.yml playbooks/vulnerabilities/10.yml --extra-vars "action=enable"

Disable

# Current directory: ansible
ansible-playbook -i inventory.yml playbooks/vulnerabilities/10.yml --extra-vars "action=disable"

Implementation

Enable

Create a template vulnerable to ESC1.

Reference:

• 10/enable/tasks/main.yml

Disable

Remove the vulnerable template.

Reference:

• 10/disable/tasks/main.yml