Summary
apache/fineract disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).
Product
Tested Version
Commit d83bdc41
Details
The ProcessorHelper#configureClient method disables hostname verification by using a hostname verifier that accepts all hostnames by always returning true. The method also uses an insecure TrustManager that trusts all certificates even self-signed certificates.
Disabled hostname verification allows an attacker to use any valid certificate when intercepting a connection. Even when the hostname of the certificate does NOT match the hostname of the connection.
An insecure TrustManager allows an attacker to create a self-signed certificate that matches the hostname of the intercepted connection.
Impact
Machine-in-the-middle attack.
CVE
Coordinated Disclosure Timeline
- 2020-10-15: Sent a mail to security@apache.org.
- 2020-10-18: Issue is patched.
- 2021-01-05: CVE id is shared with me.
- 2021-05-26: Advisory is published.
Credit
This issue was discovered and reported by @intrigus-lgtm.
Contact
You can contact the ISL at isl@intrigus.org. Please include a reference to ISL-2020-006 in any communication regarding this issue.