Improper Certificate Validation Affecting com.linecorp.armeria:armeria-xds package, versions [,1.41.0)

Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by supplying a TLS server certificate when the upstream’s validation_context omits both trusted_ca and system_root_certs, or when no validation context is configured at all. In those cases, the client accepts the connection without authenticating the peer, so traffic to the upstream can be intercepted and the user’s requests and responses can be read or altered.

Workarounds

• Always configure an explicit trusted_ca or system_root_certs in every CertificateValidationContext for xDS-managed upstreams to ensure the upstream peer certificate is actually validated and to prevent silent noVerify() acceptance of arbitrary certificates.
• Configure explicit SAN matchers on upstream TLS contexts so the upstream identity is checked even if chain validation is not providing a trust anchor, reducing the risk of a man-in-the-middle endpoint being accepted.
• Audit xDS control plane configurations to make sure no upstream cluster is deployed with an empty or missing validation_context, preventing accidental or malicious TLS peer-verification disablement.

• GitHub Commit
• GitHub Commit
• GitHub Pull Request
• Maintainer's Advisory