Improper Certificate Validation in OkHttp via Trailing-Dot Hostnames

Executive Summary

This vulnerability in OkHttp through 5.5.1 involves improper certificate validation in the CertificatePinner component. When a hostname includes a trailing dot (e.g., example.com.), the Pin.matchesHostname method fails to normalize it, allowing certificate pinning checks to be bypassed. Attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic for applications using trailing-dot hostnames.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OkHttp version is 5.5.1 or earlier. Use commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle to inspect OkHttp versions in your project. If using Android, check the app's build.gradle file for OkHttp dependencies.

Useful 0 Not Useful 0

Impact Analysis

If you use an application relying on OkHttp 5.5.1 or earlier with certificate pinning, attackers could intercept or alter your TLS traffic by exploiting trailing-dot hostnames. This could expose sensitive data like login credentials or personal information to man-in-the-middle attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by enabling man-in-the-middle attacks that intercept or modify TLS traffic. Certificate pinning bypass allows unauthorized access to sensitive data, violating encryption requirements in both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OkHttp to version 5.5.2 or later, which includes the fix for trailing-dot hostname normalization. If upgrading is not possible, avoid using trailing dots in hostnames for pinned certificates and ensure all hostname references are consistent.

Useful 0 Not Useful 0