rst0git
commented
4 years ago Hi @itay-grudev, thank you opening this issue!
Is this specific to Mac users?
dev/ssl_linux.go:
func TrustCert(cert string) error {
fmt.Printf("! Add %s to your browser to trust CA\n", cert)
return nil
}dev/ssl_darwin.go:
func TrustCert(cert string) error {
fmt.Printf("* Adding certification to login keychain as trusted\n")
fmt.Printf("! There is probably a dialog open that requires you to authenticate\n")
login, keychainError := LoginKeyChain()
if keychainError != nil {
return keychainError
}
err := exec.Command("sh", "-c",
fmt.Sprintf(`security add-trusted-cert -d -r trustRoot -k '%s' '%s'`,
login, cert)).Run()
if err != nil {
return err
}
fmt.Printf("* Certificates setup, ready for https operations!\n")
return nil
}
itay-grudev
evanphx
nonrational
ThisIsMissEm
puma-devhas a feature that allows developers to simulate https on arbitrary domains for testing purposes. The way this feature works is by installing a Root CA in your system that allowspuma-devto issue SSL certificates for arbitrary domain names on the fly. This allows developers to test as if their system was running on production environment with production URLs but still being served by localhost.The security issues comes from the fact that the Root CA can be used to issue certificates for ANY domain name for a wide array of purposes. Additionally the private key used for issuing certificates is accessible with user level permissions which means that any program ran by the user can get hold of that private key and send it to a remote location.
The attack vector that can exploit this feature is the following:
A piece of compromised software, whether that is a proprietary program or an open source dependency of a dependancy (of a dependency) could copy the file:
and send it to an attacker.
An attacker then can use this private key to issue certificates for any arbitrary domain and can potentially fake real services, software updates, etc. This means that the exploit provides an attacker with the ability to execute code on compromised machines.
In reality the users using
puma-devwill be software developers, who often have access to staging and/or production systems. Therefore this attack can be used to obtain access to real-world applications and the personal data of enormous amount of users.While this vulnerability is not trivial to exploit it presents an attack vector that significantly weakens the security of a system and can be used to obtain access to remote systems and execute code on them.
To fix affected systems one needs to delete the
puma-devkey, cert and delete the certificate from their system. On MacOS this can be achieved with:Related: #192
Possible fixes include storing the puma-dev keys with root only access and asking for permission elevation every time a certificate needs to be issued.