René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java]: CWE 295 - Insecure TrustManager - MiTM","articleBody":"## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n- CVE-2020-26234\r\n(The CVE explicitly talks about hostname verification but at the same time it also had a insecure `TrustManager` implementation, see here:\r\n https://github.com/opencast/opencast/blob/640c5017db13b0c1875b2fe52360f873a074291c/modules/kernel/src/main/java/org/opencastproject/kernel/http/impl/HttpClientImpl.java#L119-L153)\r\n- CVE-2020-13955\r\n(The CVE explicitly talks about hostname verification but at the same time it also had a insecure `TrustManager` implementation, see here:\r\n https://github.com/apache/calcite/commit/43eeafcbac29d02c72bd520c003cdfc571de2d15 and https://github.com/apache/calcite/blob/3d13846a13398a1ba6c1fa84a7d0c0cc543f23d4/core/src/main/java/org/apache/calcite/runtime/TrustAllSslSocketFactory.java#L50)\r\n- CVE-2021-21385 (https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx)\r\n  \u003e [mifos-mobile is an] (...) Android Application built on top of the MifosX Self-Service platform for end-user customers to **view/transact** on the accounts and **loans** they hold.\r\n\r\n  Note that the fixed code is written in *Kotlin*; the app has recently been converted to a Kotlin app and the issue has been found in the semantically equivalent Java version.\r\n\r\n- CVE-2021-32700 (https://github.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5ww)\r\n  \u003e Ballerina is an open source programming language and platform for cloud-era application programmers to easily write software that just works.\r\n\r\n  This issue would have allowed a supply-chain-attack/RCE against users of Ballerina via a MitM.\r\n  The fix commit is here: https://github.com/ballerina-platform/ballerina-lang/commit/2476dcf95f9c42518702864b226376ac46bd2f8f#diff-bb49a1821c5dd9c8b726befeabc0a090e449952fd6a876106216685c8946258e\r\n\r\n## Report\r\n\r\n*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*\r\nA insecure `TrustManager` is an implementation of the `TrustManager` interface, where the `checkServerTrusted` method trusts any certificate because it never throws a `CertificateException`.\r\nAs the `TrustManager` trusts any certificate, an attacker can create a self-signed certificate that will be accepted as any certificate is trusted. This leads to a MiTM attack against the connection thereby stealing sensitive secrets such as login data or other tokens is possible.\r\n\r\n## Query\r\nhttps://github.com/github/codeql/pull/4879\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n","author":{"url":"https://github.com/intrigus-lgtm","@type":"Person","name":"intrigus-lgtm"},"datePublished":"2020-12-24T23:10:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":14},"url":"https://github.com/221/securitylab/issues/221"}