Internet Bug Bounty · Report #2435482

CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)

Validstatus

mediumseverity

$2,580bounty

48upvotes

29 Mar 2024disclosed

Summary

CVE-2024-2466 TLS certificate check bypass with mbedTLS

VULNERABILITY libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.

libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

INFO Since the SNI field is not set when using a hostname set as an IP address, many requests will fail to communicate with the correct endpoint or get the correct data. Somewhat lessening the possible impact.

Not all versions of mbedTLS supports server certificate checks for IP addresses, so when this issue is fixed all attempts to connect directly to an IP address over TLS might fail.

This vulnerability is similar to a past curl vulnerability identified as CVE-2016-3739.

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-2466 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Medium

CREDITS Reported-by: Frank Yueh Patched-by: Stefan Eissing

Full Security Advisory: https://curl.se/docs/CVE-2024-2466.html

How it was found

For reward request.

Please refer to this report issue from curl: https://hackerone.com/reports/2416725

And already published at here: https://curl.se/docs/CVE-2024-2466.html

Impact

Reference from above.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original