CVE-2020-15133: Missing TLS certificate verification in Faye Websocket
Faye faye-websocket is vulnerable to a man-in-the-middle attack, caused by the lack of certification validation in TLS handshakes. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
Other sources
In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connection#starttls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any wss: connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading faye-websocket to v0.11.0 is recommended.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15133?
CVE-2020-15133 is a vulnerability in faye-websocket that allows for man-in-the-middle attacks due to the lack of certification validation in TLS handshakes.
How severe is CVE-2020-15133?
CVE-2020-15133 has a severity rating of 8.7 (high).
What software is affected by CVE-2020-15133?
The Faye-websocket project's faye-websocket version up to and exclusive of 0.11.0 is affected by CVE-2020-15133. Additionally, IBM Security Verify Governance version up to and inclusive of 10.0 is also affected.
How does CVE-2020-15133 work?
CVE-2020-15133 occurs when the Faye::WebSocket::Client class in faye-websocket uses the EM::Connection#start_tls method in EventMachine to implement the TLS handshake, but lacks certification validation, making it vulnerable to man-in-the-middle attacks.
Is there a fix for CVE-2020-15133?
Yes, updating to version 0.11.0 or higher of faye-websocket resolves the vulnerability.