writeups.xyz / mTLS: When certificate authentication is done wrong

Submitter : c2a

Date: 17 August 2023

Bounty : undisclosed

Vulnerabilities :

• MTLS
• Improper Certificate Validation
• LDAP Injection
• SSRF

Programs :

• Keycloak
• Bouncy Castle
• Apereo CAS

Authors :

• Michael Stepankin (@Artsploit)

Link :
https://github.blog/2023-08-17-mtls-when-certificate-authentication-is-done-wrong/