[Java]: CWE 295 - Insecure TrustManager - MiTM

[intrigus-lgtm]

CVE ID(s)

List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.

• CVE-2020-26234
  (The CVE explicitly talks about hostname verification but at the same time it also had a insecure TrustManager implementation, see here:
  https://github.com/opencast/opencast/blob/640c5017db13b0c1875b2fe52360f873a074291c/modules/kernel/src/main/java/org/opencastproject/kernel/http/impl/HttpClientImpl.java#L119-L153)

• CVE-2020-13955
  (The CVE explicitly talks about hostname verification but at the same time it also had a insecure TrustManager implementation, see here:
  apache/calcite@43eeafc and https://github.com/apache/calcite/blob/3d13846a13398a1ba6c1fa84a7d0c0cc543f23d4/core/src/main/java/org/apache/calcite/runtime/TrustAllSslSocketFactory.java#L50)

• CVE-2021-21385 (GHSA-9657-33wf-rmvx)

  [mifos-mobile is an] (...) Android Application built on top of the MifosX Self-Service platform for end-user customers to view/transact on the accounts and loans they hold.

  Note that the fixed code is written in Kotlin; the app has recently been converted to a Kotlin app and the issue has been found in the semantically equivalent Java version.

• CVE-2021-32700 (GHSA-f5qg-fqrw-v5ww)

  Ballerina is an open source programming language and platform for cloud-era application programmers to easily write software that just works.

  This issue would have allowed a supply-chain-attack/RCE against users of Ballerina via a MitM.
  The fix commit is here: ballerina-platform/ballerina-lang@2476dcf#diff-bb49a1821c5dd9c8b726befeabc0a090e449952fd6a876106216685c8946258e

Report

Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
A insecure TrustManager is an implementation of the TrustManager interface, where the checkServerTrusted method trusts any certificate because it never throws a CertificateException.
As the TrustManager trusts any certificate, an attacker can create a self-signed certificate that will be accepted as any certificate is trusted. This leads to a MiTM attack against the connection thereby stealing sensitive secrets such as login data or other tokens is possible.

Query

github/codeql#4879

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

[smowton]

@intrigus-lgtm this relates to github/codeql#3581 right?

[smowton]

And/or github/codeql#4536 ? (If the latter, could you answer my review questions?)

[smowton]

Or even github/codeql#4879 ?

[intrigus-lgtm]

This relates to github/codeql#4879.

I just added a link to the query in the issue.

I will try to apply your review questions/suggestions from github/codeql#4536 to github/codeql#4879 to the extend that the code in questions still exists.

[smowton]

I now see that there's also #222 -- might be worth commenting briefly about the difference between the two

[intrigus-lgtm]

I now see that there's also #222 -- might be worth commenting briefly about the difference between the two

#221 is for the "The Bug Slayer" bounty and #222 is for the "All For One" bounty.
Both use the same query.

[JarLob]

Hey @intrigus-lgtm I'll take this out of our bounty pipeline for now similarly to #108
Feel free to re-submit when you get the extra CVEs.

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

[JarLob]

I'm going to close the issue. Feel free to re-open it when ready.

[intrigus-lgtm]

@JarLob please re-open 🎉 🎉

[ghsecuritylab]

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[xcorail]

Created Hackerone report 1264781 for bounty 317584 : [221] [Java]: CWE 295 - Insecure TrustManager - MiTM

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed