# Pwn2Own Miami 2022: Unified Automation C++ Demo Server DoS

Unified Automation OPC UA C++ Demo Server loops forever walking a cyclic certificate chain during pre-auth trust check, crashing availability.

- Payout: unconfirmed
- Severity: high
- Program: Unified Automation
- Credited: Sector 7
- Disclosed: 2022-09-14
- CVE: CVE-2022-37013
- Write-up quality: 7/10
- Original: https://sector7.computest.nl/post/2022-09-unified-automation-opcua-cpp/
- Library page: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-unified-automation-opcua-cpp
- Tags: domain:iot impact:dos kind:bounty platform:blog sev:high technique:chained technique:source-review vuln:auth-bypass vuln:dos

**Target:** OPC UA C++ Demo Server certificate verification (uastack.dll)
**Root cause:** OpcUa_P_OpenSSL_CertificateStore_IsExplicitlyTrusted walks the issuer chain in a while loop without cycle detection; a certificate chain where A is issued by B and B by A never terminates.
**Steps:**
1. Generate RSA keypairs A and B.
2. Build cert A with subject A, issuer B, signed by B's private key; build cert B with subject B, issuer A, signed by A's private key.
3. Connect to the OPC UA server presenting cert A with cert B as an additional certificate in the chain.
4. Server enters infinite loop in IsExplicitlyTrusted, spins at 100% CPU, becomes unresponsive to all clients.
**How found:** While auditing the certificate verification function to bypass the trusted application check, they read the chain-walking while loop and hypothesized that a cyclic issuer chain would never terminate, then built mutually-signed certs to confirm.
**Exploitation:** Pre-authentication: attacker sends a client certificate chain containing a two-cert cycle (A issued by B, B issued by A). The trust-check loop never reaches a self-signed terminator, hanging the single-threaded server and denying service to all clients.
**Insight:** When a trust-check walks issuer chains, test cyclic chains (mutually-signed certs) rather than only self-signed loops; single-threaded network handlers turn any unbounded loop into a pre-auth DoS.