  Over recent years, the Resource Public Key Infrastructure (RPKI) has seen
increasing adoption, with now 37.8% of the major networks filtering bogus BGP
routes. Systems interact with the RPKI over Relying Party (RP) implementations
that fetch RPKI objects and feed BGP routers with the validated
prefix-ownership data. Consequently, any vulnerabilities or flaws within the RP
software can substantially threaten the stability and security of Internet
routing. We uncover severe flaws in all popular RP implementations, making them
susceptible to path traversal attacks, remotely triggered crashes, and inherent
inconsistencies, violating RPKI standards. We report a total of 18
vulnerabilities that canbe exploited to downgrade RPKI validation in border
routers or, worse, enable poisoning of the validation process, resulting in
malicious prefixes being wrongfully validated and legitimate RPKI-covered
prefixes failing validation. Furthermore, our research discloses
inconsistencies in the validation process, with two popular implementations
leaving 8149 prefixes unprotected from hijacks, 6405 of which belong to Amazon.
While these findings are significant in their own right, our principal
contribution lies in developing CURE, the first-of-its-kind system to
systematically detect bugs, vulnerabilities, and RFC compliance issues in RP
implementations via automated test generation. CURE is a powerful RPKI
publication point emulator that enables easy and efficient fuzzing of complex
RP validation pipelines. It is designed with a set of novel techniques,
utilizing differential and stateful fuzzing. We generated over 600 million test
cases and tested all popular RPs on them. Following our disclosure, the vendors
already assigned CVEs to the vulnerabilities we found.
