GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
Summary
The GoAhead embedded web server had a flaw where it loaded a certificate revocation list but failed to enable revocation checking. This allowed revoked client certificates to be accepted for login on affected systems, and also enabled session decryption when using OpenSSL with mutual TLS.
IFF Assessment
The identified vulnerability allows attackers to bypass authentication using revoked certificates and potentially decrypt sessions, posing a direct threat to system security.
Severity
This vulnerability allows for authentication bypass and session decryption. It has a high attack complexity due to the requirement of a revoked client certificate, but the impact on confidentiality and integrity is significant, leading to an estimated CVSS score of 8.1 (High).
Defender Context
This vulnerability highlights the critical importance of ensuring that TLS configurations, especially certificate revocation checks, are properly enabled and verified. Defenders should prioritize patching or updating GoAhead embedded web server instances and review their mutual TLS implementations to prevent unauthorized access and session hijacking.