# Web protection component in Anti-Virus products family uses predictable links for certificate warnings

Kaspersky AV warning pages used predictable sequential link_ids and a fixed GUID, letting any website forge certificate-override, Safe Money, and anti-phishing confirmation links.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-25
- CVE: CVE-2019-15688
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/469372
- Library page: https://bugbountylibrary.com/r/h1%3A469372
- Tags: area:os domain:desktop impact:integrity kind:bounty platform:hackerone sev:medium tech:firefox technique:recon vuln:auth-bypass vuln:business-logic vuln:idor

**Target:** Kaspersky web protection warning pages (certificate, Safe Money, anti-phishing)
**Root cause:** Warning-page action links use a fixed GUID plus a monotonically incrementing link_id, so a site that obtains one link can predict all future ones; warning pages are also first-party to the offending site, exposing the links.
**Steps:**
1. Add `93.184.216.34 www.google.com` to hosts to simulate MitM.
2. Visit https://www.google.com/ to trigger Kaspersky certificate warning.
3. Run `rebinding_server.py` serving https://localhost:5000/ alternating valid/invalid certs via http://localhost:5001/.
4. Open `https://localhost:5000/certerror_override.html`, which downloads its own cert warning page and reads the predictable override link.
5. Click the fake 'I understand the risks' link, then 'Continue' on the real Kaspersky prompt.
6. Redirect to https://www.google.com/ succeeds with certificate warning gone.
7. Repeat with `disable_safemoney.html` to permanently disable Safe Money for bankofamerica.com.
8. Repeat with `phishing_override.html` to bypass anti-phishing warning for amtso.org until restart.
**How found:** Observed the warning-page link format `?<link_id>_kis_cup_<GUID>_` and noticed GUID constant and link_id sequential across cert, Safe Money, and anti-phishing prompts; realized the warning page is first-party so a site can read its own links.
**Exploitation:** Attacker site serves a valid cert to load, then switches to an invalid cert so Kaspersky renders its warning page first-party; the page reads the override link (predictable GUID+link_id) and auto-triggers it, overriding cert warnings, disabling Safe Money, or bypassing anti-phishing without user knowledge.
**Escalation:** Chained with a MitM on public WiFi to force certificate override for high-profile sites, effectively disabling SSL MitM protection.
**Insight:** When a security product renders interstitial pages in the context of the untrusted origin, treat those pages as attacker-readable: check whether action tokens are sequential/static and whether the interstitial is same-origin with the site it warns about.