Faye up to 1.3.x Certificate Verification EM::Connection#start_tls TLS Certificate certificate validation

Summaryinfo

A vulnerability described as critical has been identified in Faye up to 1.3.x. Affected by this issue is the function EM::Connection#start_tls of the component Certificate Verification. Such manipulation as part of TLS Certificate leads to certificate validation. This vulnerability is listed as CVE-2020-15134. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Faye up to 1.3.x. Affected by this issue is the function EM::Connection#start_tls of the component Certificate Verification. The manipulation as part of a TLS Certificate leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is confidentiality. CVE summarizes:

Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `https:` or `wss:` connection made using these libraries is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. The first request a Faye client makes is always sent via normal HTTP, but later messages may be sent via WebSocket. Therefore it is vulnerable to the same problem that these underlying libraries are, and we needed both libraries to support TLS verification before Faye could claim to do the same. Your client would still be insecure if its initial HTTPS request was verified, but later WebSocket connections were not. This is fixed in Faye v1.4.0, which enables verification by default. For further background information on this issue, please see the referenced GitHub Advisory.

The weakness was presented 07/31/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2020-15134 since 06/25/2020. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 1.4.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Faye

Version

• 1.0
• 1.1
• 1.2
• 1.3

Website

• Product: https://github.com/faye/faye/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion