CVE-2022-24968 Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket
An attacker can redirect WebSocket connections to malicious servers by spoofing DNS records, bypassing TLS verification in the Mellium XMPP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24968?
CVE-2022-24968 is a medium-severity server-side request forgery vulnerability in n/a, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
Weakness: CWE-295
Which versions are affected by CVE-2022-24968?
5 open source packages ship an affected version, including mellium.im/xmpp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mellium.im/xmpp Go | From 0.18.0 | 0.21.1 |
mellium.im/xmpp Go | From 0.18.0 | 0.21.1 |
mellium.im/xmpp Go | From 0.18.0 | 0.21.1 |
mellium.im/xmpp Go | From 0.18.0 | 0.21.1 |
mellium.im/xmpp Go | From 0.18.0 | 0.21.1 |
Products include Mellium Xmpp.
How do I fix CVE-2022-24968?
Upgrade mellium.im/xmpp to 0.21.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-24968 being exploited?
There is no known exploitation of CVE-2022-24968 in the wild and no public exploit code.
Sources
Also known as GHSA-h289-x5wc-xcv8, GHSA-m658-p24x-p74r, GO-2022-0370.