# Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass

OPC UA .NET Standard built two certificate chains without comparing them, letting a crafted cert with case-flipped root name bypass the Trusted Application Check.

- Payout: unconfirmed
- Severity: high
- Program: OPC Foundation
- Credited: Sector 7
- Disclosed: 2022-07-19
- CVE: CVE-2022-29865
- Write-up quality: 9/10
- Original: https://sector7.computest.nl/post/2022-07-opc-ua-net-standard-trusted-application-check-bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-07-opc-ua-net-standard-trusted-application-check-bypass
- Tags: domain:infra impact:integrity impact:internal-access kind:bounty platform:blog sev:high tech:dotnet technique:parser-differential technique:source-review vuln:auth-bypass vuln:crypto

**Target:** OPC UA server certificate validation (CertificateValidator.InternalValidate)
**Root cause:** GetIssuersNoExceptionsOnGetIssuer builds a chain using case-insensitive DN matching plus forgeable serial/AKI metadata, while X509Chain.Build builds a different chain; the code never verifies the two chains are equal and CheckChainStatus ignores UntrustedRoot on the root element.
**Steps:**
1. Connect to server, read its certificate to obtain trusted root's Issuer DN and AKI serial.
2. Generate self-signed CA cert with CN case-flipped (CN=rOOT vs CN=Root), CA=TRUE; host as PEM at `http://attacker/root.pem`.
3. Generate leaf cert CN=FakeCert signed by fake root, with AKI DirName:/CN=rOOT and serial matching real root, plus AIA CA Issuers URI `http://attacker/root.pem`, valid dates, keyUsage Data Encipherment.
4. Connect to OPC UA server presenting FakeCert; GetIssuers matches CN=Root case-insensitively and trusts it, while X509Chain.Build fetches fake root via AIA and yields UntrustedRoot which CheckChainStatus ignores.
5. Session established as trusted application without a valid cert.
**How found:** Code review of CertificateValidator.InternalValidate: noticed two separate chain constructions (GetIssuersNoExceptionsOnGetIssuer vs X509Chain.Build) with no equality check, and that Match/CompareDistinguishedName does case-insensitive component comparison on forgeable metadata before signature verification.
**Exploitation:** Attacker with internal ICS network access presents the crafted FakeCert chain during OPC UA handshake; server accepts it as trusted, granting a session to read/write data and disrupt ICS processes. Same trick impersonates a server to a client and bypasses X.509 user authentication.
**Escalation:** Same bypass applies to client-side server impersonation and to X.509-based User Authentication, extending impact beyond the trusted application check.
**Insight:** When a validator builds a chain twice via different code paths, look for missing equality checks between them; also flag non-standard DN comparison (case-insensitive, reordered components) as a way to make one path match a trusted root while the other resolves elsewhere via AIA.