CVE-2024-37920 — Certifi Improper Certificate Validation¶

Key facts

CVE-2024-37920 is a Critical vulnerability: Certifi Improper Certificate Validation. This entry ships a detection-only PoC.


CVE	CVE-2024-37920
Severity	Critical
Detection / prevention	—
PoC	poc.py
Source	2024/CVE-2024-37920/

Details¶

Overview¶

A critical vulnerability in the certifi Python package allows improper certificate validation when processing certain certificate chains. This can lead to acceptance of untrusted certificates, enabling man-in-the-middle attacks on HTTPS connections.

Vulnerability Details¶

CVE ID: CVE-2024-37920
CVSS Score: 9.8 (Critical)
CWE: CWE-295 (Improper Certificate Validation)
Package: certifi (Python)

Affected Products¶

certifi versions before 2024.2.2
All Python applications using affected certifi versions
Common affected packages: requests, urllib3, httpx, aiohttp

Technical Details¶

The certifi package provides Mozilla's CA Certificate bundle for Python applications. This vulnerability exists in how certain certificate chains are processed, potentially allowing:

Acceptance of certificates signed by untrusted CAs
Man-in-the-middle attacks on HTTPS connections
Interception of sensitive data in transit
Certificate chain validation bypass

Attack Vector¶

Attacker positions themselves in network path (MITM)
Attacker presents malicious certificate chain
Vulnerable certifi version fails to properly validate chain
Python application accepts the invalid certificate
Attacker can intercept/modify encrypted traffic

Impact¶

Confidentiality: High - Encrypted data can be intercepted
Integrity: High - Data in transit can be modified
Availability: Low - Primarily affects data security

Proof of Concept¶

Usage¶

# Check local environment for vulnerable certifi
python3 poc.py -c

# Scan a specific project directory
python3 poc.py -c --scan-dir /path/to/project

# Version check only (passive)
python3 poc.py -c --version-only

Verification Methods¶

Version Check: Verifies installed certifi version
Pip Package Scan: Scans all pip packages for certifi
Requirements Scan: Searches requirements.txt files
Certificate Validation Test: Tests actual SSL validation
CA Bundle Integrity Check: Verifies CA bundle is intact

Detection¶

Check for vulnerable certifi versions in your environment:

# Check installed version
pip show certifi

# Check for vulnerable version in requirements
grep -r "certifi" requirements*.txt

# Audit with pip-audit
pip-audit --vulnerability-source osv

Mitigation¶

Upgrade Immediately: Update certifi to version 2024.2.2 or later
```
pip install --upgrade certifi>=2024.2.2
```

Audit Dependencies: Check all projects for certifi usage

pip list | grep certifi
pipdeptree -r -p certifi

Update Requirements: Pin minimum certifi version
```
certifi>=2024.2.2
```

Verify Update: Confirm the upgrade was successful

import certifi
print(certifi.__version__)  # Should be >= 2024.2.2

Affected Ecosystem¶

Many popular Python packages depend on certifi: - requests - urllib3 - httpx - aiohttp - httplib2 - pip (internally)

Upgrading certifi will protect all applications using these packages.

References¶

Disclaimer¶

This proof of concept is provided for authorized security testing and educational purposes only. Use responsibly to identify vulnerable systems within your organization.

Frequently asked questions¶

What is CVE-2024-37920?¶

CVE-2024-37920 is a Critical vulnerability: Certifi Improper Certificate Validation. This entry ships a detection-only PoC.

How do I detect CVE-2024-37920?¶

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2024-37920?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.