Listen to this Post
The vulnerability, CVE-2024-36411, stems from a critical misconfiguration of mutual TLS (mTLS) in the Hydraide gRPC framework. While a standard TLS tunnel secures data in transit between client and server, the implementation lacked mandatory client certificate authentication. On the client side, the `NewClientTLSFromFile` method was used without providing a client certificate for authentication, only a CA to verify the server. Conversely, the server’s TLS configuration was missing the crucial `ClientCAs` setting (to define which Certificate Authorities are trusted for client certs) and `ClientAuth` was not set to RequireAndVerifyClientCert. This one-sided TLS allows any entity to establish a connection to the server without proving its identity, as the server does not request or validate a client certificate. An adversary can exploit this by simply modifying a client to use `InsecureSkipVerify: true` or by presenting any certificate, bypassing all authentication. Data on the server is then exposed, as the system incorrectly trusts all connected clients.
Platform: Hydraide
Version: < server/v2.2.1
Vulnerability: Improper Authentication
Severity: Critical
date: 2024-06-19
Prediction: Patch: 2024-06-19
What Undercode Say:
git clone https://github.com/hydraide/hydraide cd hydraide/sdk/go/hydraidego/client/
// Vulnerable Code (client.go ~line 221)
creds, certErr := credentials.NewClientTLSFromFile(server.CertFilePath, hostOnly)
// Exploit Code Modification
tlsConfig := &tls.Config{InsecureSkipVerify: true}
creds := credentials.NewTLS(tlsConfig)
How Exploit:
Modify client code.
Disable certificate verification.
Connect to server.
Access data.
Protection from this CVE
Upgrade to hydraidectl/v0.2.1.
Upgrade server to v2.2.1.
Re-initialize server instances.
Impact:
Data exposure.
No authentication bypass.
Complete system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
