Forge: TLS client crash on an unsupported ServerHello compression method

Summary

A forge.tls client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes connection.process() throw an uncaught Error when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.

Details

The client's ClientHello offers only the null compression method. tls.parseHelloMessage() in lib/tls.js stores the ServerHello's compression_method for the client without checking it (the code has a TODO: handle compression methods). When the client handles ServerHelloDone it calls tls.createConnectionState(), which throws Error('Unsupported compression algorithm.') for any method other than null (0) and deflate (1). The exception propagates out of connection.process().

The ServerHello isn't authenticated until the server's Finished message, so an on-path attacker can change the compression byte of a genuine ServerHello; the certificate chain still verifies. Applications that pass socket data to process() without catching exceptions terminate. This includes forge.tls.wrapSocket, which calls process() from its socket data handler, and forge.http, which uses it. A deflate (1) method, also never offered, makes the handshake fail later with an error instead of a crash.

Servers are not affected: a server always selects no compression.

The fix fails the handshake with an illegal_parameter alert, through the connection's error callback, when the ServerHello selects any compression method other than null.

Patches

Fixed in node-forge 1.4.3.

Workarounds

Catch exceptions thrown by connection.process() and close the socket.

Resources

• RFC 5246, section 7.4.1.3 (Server Hello): https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.3
• Related: GHSA-525v-9gp9-w22h (another TLS client crash during the handshake, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h

Severity

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)
CVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)
CVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.

Credits

Reported by @alienkeric.

Proof of concept

A server (or on-path attacker) sends a ServerHello with compression_method 0xff, followed by a valid Certificate and ServerHelloDone:

client.handshake();
client.process(serverHello + certificate + serverHelloDone);
// <= 1.4.2: throws Error: Unsupported compression algorithm.
// 1.4.3: error callback with "Unsupported compression method."

The reporter's PoC (a CA-issued server certificate and the default verify callback) is in tests/pocs/ghsa-w4xr-hqv8-ch44.js, and regression tests are in tests/unit/tls.js.

Impact

Applications that use forge.tls as a client (directly, through forge.tls.wrapSocket, or through forge.http) and pass data from a network socket to connection.process() are affected. The server they connect to, or an on-path attacker, can make process() throw before the server is authenticated; if the application doesn't catch it, the Node.js process terminates, dropping all its connections. Servers built on forge.tls are not affected. There is no confidentiality or integrity impact.