CVE-2025-42921 - Improper Validation of Certificate with Host Mismatch

Severity

65%

Complexity

39%

Confidentiality

41%

In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin

CVSS 3.1 Base Score 6.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Demo Examples

Improper Validation of Certificate with Host Mismatch

CWE-297

The following OpenSSL code obtains a certificate and verifies it.


               
}

                     

                           // do secret things

Even though the "verify" step returns X509_V_OK, this step does not include checking the Common Name against the name of the host. That is, there is no guarantee that the certificate is for the desired host. The SSL connection could have been established with a malicious host that provided a valid certificate.

Overview

First reported 3 months ago

2025-04-17 16:15:00

Last updated 3 months ago

2025-04-23 15:25:00

Affected Software

Jetbrains Toolbox

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.