CWE-296: Improper Following of a Certificate's Chain of Trust

What is Improper Following of a Certificate's Chain of Trust?

• Overview: Improper Following of a Certificate's Chain of Trust is a vulnerability where a system fails to correctly verify the entire chain of trust of a certificate, which is necessary to ensure that the certificate is legitimate and can be trusted. This happens when the system does not verify the certificate from the end entity back to the trusted root certificate.

• Exploitation Methods:

• Attackers can present a certificate that appears valid but is not backed by a trusted root, tricking the system into accepting it.
• Common attack patterns include using self-signed certificates or manipulating intermediate certificates to appear trustworthy.

• Security Impact:

• Direct consequences include unauthorized access to resources or systems by malicious entities.
• Potential cascading effects involve man-in-the-middle attacks, where attackers intercept and alter communications.
• Business impact includes data breaches, loss of customer trust, and potential legal repercussions.

• Prevention Guidelines:

• Specific code-level fixes include implementing strict certificate validation processes that fully verify the chain of trust.
• Security best practices involve always checking each certificate in the chain, ensuring no self-signed certificates are used unless they are root certificates, and verifying important certificate extensions.
• Recommended tools and frameworks include using established libraries for certificate validation that are regularly updated and maintained, such as OpenSSL or the certificate validation features in modern web frameworks.

Corgea can automatically detect and fix Improper Following of a Certificate's Chain of Trust in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Low

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

const https = require('https');

// Vulnerable code: This code disables certificate verification, which can lead to man-in-the-middle attacks.
const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET',
  rejectUnauthorized: false  // Disables certificate verification, accepting any certificate
};

https.request(options, (res) => {
  res.on('data', (d) => {
    process.stdout.write(d);
  });
}).end();

How to fix Improper Following of a Certificate's Chain of Trust?

To fix this vulnerability in JavaScript (Node.js), ensure that the rejectUnauthorized option is set to true (or omitted, as it's true by default). This ensures the server's SSL/TLS certificate is properly verified against trusted root certificates, preventing acceptance of self-signed or otherwise invalid certificates, and enforcing the chain of trust.

Fixed Code Example

const https = require('https');

// Fixed code: Enables proper verification of the server's certificate chain.
const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET'
  // By default, rejectUnauthorized is true, which enforces certificate verification.
};

https.request(options, (res) => {
  res.on('data', (d) => {
    process.stdout.write(d);
  });
}).end();

By following these practices, you ensure that your applications securely communicate over SSL/TLS, adhering to the proper chain of trust principles. This prevents potential man-in-the-middle attacks by ensuring that the server's certificate is valid and trusted.