CLI Ambush

The talk opens with a refresher on X.509 certificates and ASN.1, covering how structures are defined abstractly and then encoded in BER and DER, and why PEM is used to move them as text. It then presents a small Perl tool that converts a DER file into an OpenSSL configuration template, so a certificate can be edited as text without manually recalculating length fields.

The middle section moves from parsing to output. The speaker found that OpenSSL's ASN.1 printing could pass control characters through to the terminal, so certificate name fields and subject alternative name fields could carry escape sequences that change what a viewer sees. Demonstrations included a signing request whose common name hid extra text, and an alternative name field that could clear the screen and display different content. Behaviour varied across OpenSSL versions and terminal emulators. Surveying a large certificate dataset turned up unusual fields with backspaces and embedded line breaks, but no clear real-world exploitation.

The closing part frames the risk: an administrator who approves a request based on a command-line view may be shown something other than the real contents. The practical takeaway is to avoid trusting raw tool output for certificates, to pipe it through a pager, or to inspect it with a hex view before making decisions.