Listen to this Post
The vulnerability is rooted in the REST wrapper implementation of the epa4all-client. Instead of using the Java runtime’s default `PKIXTrustManager` (which validates certificate chains, hostnames, and expiration), the library employs a custom `TrustAllTrustManager` that blindly trusts any TLS certificate presented by the server.
This means:
- The client never verifies the certificate chain – a self‑signed or expired leaf certificate is accepted as valid.
- Hostname verification is skipped, so the certificate’s CN/SAN can be completely unrelated to the target server (e.g., `example.com` instead of
konnektor.domain). - Certificate expiration checks are absent – even a long‑expired certificate passes the handshake.
- The OCSP or CRL revocation checks are not enforced, so a revoked certificate still establishes a “secure” connection.
The flaw affects all SOAP‑over‑TLS traffic exchanged between the ePA service and the Konnektor. An attacker positioned on the network path can:
1. Intercept the TLS handshake.
- Present any TLS certificate (self‑signed, expired, mismatched CN).
- Because the client accepts it, the attacker completes the handshake and establishes a man‑in‑the‑middle (MITM) session.
Once the MITM position is achieved, all data passed through the SOAP channel is exposed to the attacker. This includes:
– Patient identifiers (KVNR)
– SMC‑B card operations (authentication, signing)
– Document content (ePA documents, medical data)
– Credential exchanges (passwords, tokens, certificates)
The vulnerable code was present in all released versions before 1.2.2. The fix (commit 36) removes the custom `TrustAllTrustManager` and reinstates full, proper TLS certificate validation.
DailyCVE Form
Platform: Maven epa4all-client
Version: before 1.2.2
Vulnerability: TLS validation disabled
Severity: High
date: 2026-05-11
Prediction: Patch 2026-05-25
What Undercode Say
Bash command to test if a server blindly trusts any certificate:
Attempt a connection to the ePA endpoint with a self‑signed certificate openssl s_client -connect vulnerable-epa-host:443 -CAfile /path/to/self-signed.pem -verify_return_error
Java code snippet demonstrating the dangerous TrustManager:
// The vulnerable TrustAllTrustManager used before the patch
TrustManager[] trustAllCerts = new TrustManager[] {
new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; }
public void checkClientTrusted(X509Certificate[] certs, String authType) { }
public void checkServerTrusted(X509Certificate[] certs, String authType) { } // <- accepts anything
}
};
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
Exploit
- ARP spoof / route hijack the network between the ePA service and the Konnektor.
- Use a MITM tool (e.g.,
mitmproxy,bettercap, or a customopenssl s_server) to intercept the TLS handshake. - Present any TLS certificate – self‑signed, expired, or with a wrong CN.
- The vulnerable client accepts the certificate without any warning.
- Decrypt, read, and modify all SOAP messages in real time.
Protection from this CVE
- Upgrade to version 1.2.2 or later (the patch fully re‑enables standard TLS validation).
- Do not use the REST wrapper when full certificate validation is required; call the underlying library directly (as suggested in the workaround).
- Enforce network segmentation so that only trusted, physically controlled paths exist between the ePA service and the Konnektor.
- Monitor for unusual TLS handshakes (e.g., certificates that do not chain to a known CA).
Impact
- Complete data exposure – patient identifiers, medical documents, and authentication credentials are leaked.
- Man‑in‑the‑middle enables active modification of requests/responses, potentially altering clinical data or transaction outcomes.
- Authentication bypass – SMC‑B card operations can be replayed or redirected, undermining the security of the entire Telematik infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
