Fix MiM Security vulnerability: missing SSL hostname validation

[alromh87]

📊 Metadata *

em-imap is a gem that allows you to connect to an IMAP4rev1 server in a non-blocking fashion.

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). The hostname in a TLS server certificate is not verified. An attacker can acquire the identity of a trusted server and implement malicious data.

Bounty URL: https://www.huntr.dev/bounties/1-rubygems-em-imap/

⚙️ Description *

SSL validation was not implemented making em-imap vulnerable to MiM attacks, fixed adding validations.

💻 Technical Description *

ssl_verify_peer param is eneabled when calling connect from EventMachine::Connection, this will call ssl_verify_peer and ssl_handshake_completed of the connection module for the calling programm to implement validation logic.

Validation of Server certificate was implemented using openssl based on code from:
lostisland/faraday@63cf47c

🐛 Proof of Concept (PoC) *

1. Add a fake DNS entry to /etc/hosts.
   echo "127.0.0.1 test.imap.gmail.com" | sudo tee -a /etc/hosts

2. Create a certificate.
   openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

3. Listen on port 443 with TLS enabled.
   openssl s_server -key key.pem -cert cert.pem -accept 443

4. Create sample client:

#clientPoc.rb
require 'rubygems'
require 'em-imap'

EM::run do
  client = EM::IMAP.new('test.imap.gmail.com', 993, true)
  client.connect.errback do |error|
    puts "Connecting failed: #{error}"
  end.callback do |hello_response|
    puts "Connecting succeeded!"
    puts hello_response
  end.bothback do
    EM::stop
  end
end

5. Run the test client
   ruby clientPoc.rb
6. Client will connect ignoring the self signed certificate

🔥 Proof of Fix (PoF) *

After fix Invalid certificate is detected and connection terminated

Valid certificate for wrong server will also be detected and connection aborted

👍 User Acceptance Testing (UAT)

After fix functionality is unafected

[Mik317]

LGTM 😄 🎉

Cheers,
Mik

[mufeedvh]

Clean fix! 👏🔥

[huntr-helper]

Congratulations alromh87 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section, or hit us up on Discord. Your bounty is on its way - keep hunting!

Come join us on Discord