What to Do When Creating Your CodeQL Database Fails – and How to Report the Perfect Reproducer Using cvise
How to debug CodeQL database creation failures, identify the root cause from build-tracer logs, and create minimal reproducers using cvise.
Intrigus’ Security Lab
A tiny contribution on securing the world's software
Latest posts
RealworldCTF 2024 – Protected-by-Java-SE – Writeup
How to find XXE in CodeQL using CodeQL – unintended CTF challenge solution.
Fixing Decompilation of Stack Clash Protected Binaries
How to fix decompilation when everything looks ugly, because stack probing breaks stack pointer tracking.
BraekerCTF 2024 – Injecting Commands – Writeup
How to reverse engineer a Mach-O binary from BraekerCTF 2024 that breaks all tools.
ISL-2020-005: Missing Hostname Verification and Insecure TrustManager in apache/calcite
The `HttpUtils#getURLConnection` function of apache/calcite before commit 43eeafc disabled hostname verification and used an insecure `TrustManager` for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).
ISL-2020-006: Missing Hostname Verification and Insecure TrustManager in apache/fineract
apache/fineract before commit e054a6f disabled hostname verification and used an insecure `TrustManager` for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).
ISL-2020-007: Missing Hostname Verification and Insecure TrustManager in opencast/opencast
opencast/opencast before commit 4225bf9 disabled hostname verification and used an insecure `TrustManager` for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).
ISL-2020-008: Missing Hostname Verification and Insecure TrustManager in openMF/mifos-mobile
openMF/mifos-mobile before commit e505f62 disabled hostname verification and used an insecure `TrustManager` for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).
ISL-2021-001: Insecure TrustManager in ballerina-platform/ballerina-lang
ballerina-platform/ballerina-lang before commit d7e08e0 used an insecure `TrustManager` for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM) and Remote code execution (RCE).
Finding Insecure TrustManagers and Disabled Hostname Verification with CodeQL
Certificates are a cornerstone of what makes Internet communication secure. In this post, I'm going to show how to find multiple CVEs in usage of the Java `TrustManager` and `HostnameVerifier` classes.