Issue metadata
Sign in to add a comment
|
Security: SSL Subdomain not verified if certificate is in Main request
Reported by
r...@b-funky.nl,
Apr 12 2016
|
||||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS When opening for https://www.b-funky.nl/ssltest.html it will do a request to https://static.b-funky.nl also. I deliberately serving a different certificate on this domain. Chrome doesn't verify the certificate of the subdomain and just handles it as secure. VERSION Chrome Version: 49.0.2623.112 stable Operating System: [OSX 10.11.4] REPRODUCTION CASE Open demo url in chrome: https://static.b-funky.nl Open demo url in safari to see warnings or use openssl to get certificate from www.b-funky.nl:443 and static.b-funky.nl:443 (return wrong domainname)
,
Apr 12 2016
Sorry, My report was a bit sloppy but I had to leave and want to make sure that this issue reached you as soon as possible since it can have a big impact for people who think there connection is completely save. I do think that the test url https://www.b-funky.nl/ssltest.html will give you enough information but don't hesitate to contact me. I'll keep the certificate setup online until the bug is confirmed.
,
Apr 12 2016
net-internals shows HTTP2_SESSION_POOL_FOUND_EXISTING_SESSION_FROM_IP_POOL for the subresource request to static.b-funky.nl, so it's due to session pooling. I think this is WAI -- it should be okay to use a connection from the pool for the subresource request if the connection has a valid certificate for it -- but not sure.
,
Apr 12 2016
Yeah, the subjectAltName on the original cert covers www.b-funky.nl and static.b-funky.nl so this is WAI
,
Apr 12 2016
Removing view restriction.
,
Apr 12 2016
To clarify in case this was unclear: we're not failing to verify static.b-funky.nl's bad certificate. We never make a new connection to begin with. The connection to www.b-funky.nl is still open, and that connection's certificate is good for both www.b-funky.nl and static.b-funky.nl (check the SANs), so we'll use the same HTTP/2 (or SPDY) session for requests to either host. HTTP/2 explicitly allows doing this.
,
Apr 12 2016
Thnx for the fast response. Perfectly clear. Will remove the testfile.
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by tsepez@chromium.org
, Apr 12 2016Status: Assigned (was: Unconfirmed)