{"id":"RUSTSEC-2023-0029","summary":"TLS certificate common name validation bypass","details":"The NATS official Rust clients are vulnerable to MitM when using TLS.\n\nThe common name of the server's TLS certificate is validated against\nthe `host`name provided by the server's plaintext `INFO` message\nduring the initial connection setup phase. A MitM proxy can tamper with\nthe `host` field's value by substituting it with the common name of a\nvalid certificate it controls, fooling the client into accepting it.\n\n## Reproduction steps\n\n1. The NATS Rust client tries to establish a new connection\n2. The connection is intercepted by a MitM proxy\n3. The proxy makes a separate connection to the NATS server\n4. The NATS server replies with an `INFO` message\n5. The proxy reads the `INFO`, alters the `host` JSON field and passes\n   the tampered `INFO` back to the client\n6. The proxy upgrades the client connection to TLS, presenting a certificate issued\n   by a certificate authority present in the client's keychain.\n   In the previous step the `host` was set to the common name of said certificate\n7. `rustls` accepts the certificate, having verified that the common name matches the\n   attacker-controlled value it was given\n9. The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate","aliases":["GHSA-wvc4-j7g5-4f79"],"modified":"2023-11-08T09:57:41Z","published":"2023-03-24T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/nats"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2023-0029.html"}],"affected":[{"package":{"name":"nats","ecosystem":"crates.io","purl":"pkg:cargo/nats"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.24.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"arch":[],"functions":[]}},"database_specific":{"categories":["crypto-failure"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0029.json"}}],"schema_version":"1.7.3"}