mirror of
https://github.com/nodejs/node.git
synced 2025-05-03 09:23:11 +00:00
2e1b41a708
Prior to this patch `session` event was emitted after `secure` event on TLSSocket, but before `secureConnect` event. This is problematic for `https.Agent` because it must cache session only after verifying the remote peer's certificate. Connecting to a server that presents an invalid certificate resulted in the session being cached after the handshake with the server and evicted right after a certifiate validation error and socket's destruction. A request initiated during this narrow window would pick the faulty session, send it to the malicious server and skip the verification of the server's certificate. Fixes: https://hackerone.com/reports/811502 CVE-ID: CVE-2020-8172 PR-URL: https://github.com/nodejs-private/node-private/pull/200 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
47 lines
1.1 KiB
JavaScript
47 lines
1.1 KiB
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
const fixtures = require('../common/fixtures');
|
|
const assert = require('assert');
|
|
const tls = require('tls');
|
|
|
|
const options = {
|
|
key: fixtures.readKey('agent1-key.pem'),
|
|
|
|
// NOTE: Certificate Common Name is 'agent1'
|
|
cert: fixtures.readKey('agent1-cert.pem'),
|
|
|
|
// NOTE: TLS 1.3 creates new session ticket **after** handshake so
|
|
// `getSession()` output will be different even if the session was reused
|
|
// during the handshake.
|
|
secureProtocol: 'TLSv1_2_method'
|
|
};
|
|
|
|
const server = tls.createServer(options, common.mustCall((socket) => {
|
|
socket.end();
|
|
})).listen(0, common.mustCall(() => {
|
|
let connected = false;
|
|
let session = null;
|
|
|
|
const client = tls.connect({
|
|
rejectUnauthorized: false,
|
|
port: server.address().port,
|
|
}, common.mustCall(() => {
|
|
assert(!connected);
|
|
assert(!session);
|
|
|
|
connected = true;
|
|
}));
|
|
|
|
client.on('session', common.mustCall((newSession) => {
|
|
assert(connected);
|
|
assert(!session);
|
|
|
|
session = newSession;
|
|
|
|
client.end();
|
|
server.close();
|
|
}));
|
|
}));
|