Skip to main content

Insecure service configuration - Certificates

Need​

Secure service configuration - Proper certificate validation and verification

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of dart:io for input/output operations in Dart programming
  • Usage of the shelf_io package for handling HTTP requests and responses in Dart's Shelf framework
  • Usage of the shelf package in Dart for building web applications and HTTP middleware.

Description​

Non compliant code​

import 'dart:io';
import 'package:shelf/shelf_io.dart' as io;
import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(_echoRequest);

  // Create an HTTPS server with an insecure certificate.
  var server = HttpServer.bindSecure(
    InternetAddress.loopbackIPv4,
    8443,
    SecurityContext()
      ..useCertificateChain('path_to_certificate.pem')
      ..usePrivateKey('path_to_key.pem'),
    requestClientCertificate: false,
  );

  io.serveRequests(server, handler);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}

The above code is a simple Dart server using the Shelf framework. It is set up to use HTTPS and has a certificate and private key. However, the server has been configured insecurely, as it does not request or validate client certificates.

The line requestClientCertificate: false, indicates that the server does not request a client certificate. This means that any client can connect to the server, even if they do not have a valid certificate.

This misconfiguration can lead to Man-in-the-Middle (MitM) attacks. In a MitM attack, the attacker intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other.

In this case, an attacker could present an invalid certificate to the server, and because the server does not validate client certificates, the attacker could potentially intercept and alter the communication between the client and the server.

Steps​

  • Validate the certificate chain by checking if it's signed by a trusted Certificate Authority (CA).
  • Enable the 'requestClientCertificate' parameter in the 'bindSecure' method to true. This will force the server to request a certificate from the client, adding an extra layer of security.
  • Implement certificate pinning to ensure that the server only accepts specific certificates.
  • Regularly update and renew your certificates and keys to prevent them from being outdated or compromised.
  • Consider using a certificate revocation list (CRL) or an Online Certificate Status Protocol (OCSP) to check the revocation status of a certificate.

Compliant code​

import 'dart:io';
import 'package:shelf/shelf_io.dart' as io;
import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(_echoRequest);

  // Create an HTTPS server with a secure certificate.
  var server = HttpServer.bindSecure(
    InternetAddress.loopbackIPv4,
    8443,
    SecurityContext()
      ..useCertificateChain('path_to_certificate.pem')
      ..usePrivateKey('path_to_key.pem')
      ..setTrustedCertificates('path_to_trusted_certificates.pem'), // Add trusted certificates
    requestClientCertificate: true, // Request client certificate
  );

  io.serveRequests(server, handler);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}

The updated code now includes a secure configuration for the X.509 certificates. The SecurityContext now includes a method setTrustedCertificates which is used to set the trusted certificates that the server will use to validate the client's certificate. This ensures that the server only accepts certificates signed by a trusted Certificate Authority (CA).

The requestClientCertificate parameter in the bindSecure method is now set to true. This forces the server to request a certificate from the client, adding an extra layer of security.

Please note that this code assumes that you have a valid certificate chain file, private key file, and trusted certificates file. Make sure to replace 'path_to_certificate.pem', 'path_to_key.pem', and 'path_to_trusted_certificates.pem' with the actual paths to your files.

Remember to regularly update and renew your certificates and keys to prevent them from being outdated or compromised. Also, consider using a certificate revocation list (CRL) or an Online Certificate Status Protocol (OCSP) to check the revocation status of a certificate.

References​

Last updated on