PT-2020-14213 · Faye · Faye-Websocket
Daniel Morsing
+1
·
Published
2020-07-31
·
Updated
2021-11-18
·
CVE-2020-15133
CVSS v3.1
8.7
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
faye-websocket versions prior to 0.11.0
Description
The issue is related to a lack of certificate validation in TLS handshakes. The
Faye::WebSocket::Client class uses the EM::Connection#start tls method, which does not implement certificate verification by default. This means that any wss: connection made using this library is vulnerable to a man-in-the-middle attack, as it does not confirm the identity of the server it is connected to. The library has been updated to enable TLS verification by default, and two new options have been added to the Faye::WebSocket::Client constructor: tls.root cert file and tls.verify peer. These options allow users to provide a different set of root certificates and turn verification off entirely, respectively.Recommendations
To resolve the issue, upgrade faye-websocket to version 0.11.0.
If you need to use a different set of root certificates, use the
:root cert file option when creating a new Faye::WebSocket::Client instance.
If you need to turn verification off entirely, use the :verify peer option, but this should be a last resort.Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Faye-Websocket