Summary
opencast/opencast disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable a to machine-in-the-middle attack (MiTM).
Product
Tested Version
Commit 4b905437
Details
The HttpClientImpl class disables hostname verification by using a hostname verifier that accepts all hostnames by always returning true. The method also uses an insecure TrustManager that trusts all certificates even self-signed certificates.
Disabled hostname verification allows an attacker to use any valid certificate when intercepting a connection. Even when the hostname of the certificate does NOT match the hostname of the connection.
An insecure TrustManager allows an attacker to create a self-signed certificate that matches the hostname of the intercepted connection.
Impact
Machine-in-the-middle attack.
CVE
Github Advisories
Coordinated Disclosure Timeline
- 2020-10-16: Sent a mail to security@opencast.org.
- 2020-11-17: CVE id is shared with me.
- 2020-12-08: Issue is patched.
- 2020-12-08: Advisory is published.
Credit
This issue was discovered and reported by @intrigus-lgtm.
Contact
You can contact the ISL at isl@intrigus.org. Please include a reference to ISL-2020-007 in any communication regarding this issue.