CWE-298: Improper Validation of Certificate Expiration

What is Improper Validation of Certificate Expiration?

• Overview: Improper Validation of Certificate Expiration (CWE-298) occurs when a system fails to check or incorrectly checks the expiration date of a digital certificate, resulting in potentially trusting certificates that are no longer valid due to their age.

• Exploitation Methods:

• Attackers can exploit this vulnerability by using expired certificates to impersonate legitimate services or to intercept communications.
• Common attack patterns include man-in-the-middle attacks where attackers present expired certificates to gain unauthorized access to sensitive data.

• Security Impact:

• Direct consequences include loss of confidentiality, integrity, and authenticity of data.
• Potential cascading effects involve unauthorized access to systems and data breaches, leading to further exploitation.
• Business impact may include reputational damage, financial losses, and legal liabilities due to non-compliance with security standards.

• Prevention Guidelines:

• Specific code-level fixes involve implementing strict checks for certificate expiration dates in the authentication process.
• Security best practices include routinely updating and maintaining certificate validation logic and using libraries that automatically handle expiration checks.
• Recommended tools and frameworks include using modern SSL/TLS libraries that support proper certificate validation, such as OpenSSL or Bouncy Castle, and employing automated certificate management solutions.

Corgea can automatically detect and fix Improper Validation of Certificate Expiration in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Low

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

const https = require('https');

const options = {
  hostname: 'example.com',
  port: 443,
  method: 'GET',
  rejectUnauthorized: false  // WARNING: Disables certificate validation, including expiration checks
};

const req = https.request(options, (res) => {
  // The request proceeds without verifying the certificate's expiration status
  res.on('data', (d) => {
    process.stdout.write(d);
  });
});

req.on('error', (e) => {
  console.error(`Problem with request: \${e.message}`);
});

req.end();

How to fix Improper Validation of Certificate Expiration?

In Node.js, ensure that the rejectUnauthorized option is set to true. This setting enforces the validation of the server's SSL/TLS certificate, including expiration checks. By default, Node.js checks certificates against a list of trusted Certificate Authorities (CAs) and verifies their validity. This change helps prevent man-in-the-middle attacks by ensuring that expired or otherwise invalid certificates are not accepted.

Fixed Code Example

const https = require('https');

const options = {
  hostname: 'example.com',
  port: 443,
  method: 'GET',
  rejectUnauthorized: true  // Enforces verification of the server's certificate, including expiration
};

const req = https.request(options, (res) => {
  // The request now verifies the certificate, ensuring it hasn't expired
  res.on('data', (d) => {
    process.stdout.write(d);
  });
});

req.on('error', (e) => {
  console.error(`Problem with request: \${e.message}`);
});

req.end();

In these examples, the critical change is enabling certificate verification by setting rejectUnauthorized to true. This ensures that the SSL/TLS certificate is checked for expiration and other validity criteria, thereby mitigating the risk of man-in-the-middle attacks that exploit expired or otherwise invalid certificates.