CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js
Attackers can bypass mutual TLS client verification in fs2-io on Node.js when requestCert is enabled, allowing unauthorized connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31183?
CVE-2022-31183 is a critical authentication bypass vulnerability in typelevel fs2, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent. 2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API. 3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.
Weakness: CWE-295
Which versions are affected by CVE-2022-31183?
12 open source packages ship an affected version, including co.fs2:fs2-io, co.fs2:fs2-io_2.12 and co.fs2:fs2-io_2.13. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
co.fs2:fs2-io Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_2.12 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_2.12 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_2.13 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_2.13 Maven | From 3.1.0 | 3.2.11 |
6 more packages
co.fs2:fs2-io_3 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_3 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_sjs1_2.13 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_sjs1_2.13 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_sjs1_3 Maven | From 3.1.0 | 3.2.11 |
co.fs2:fs2-io_sjs1_3 Maven | From 3.1.0 | 3.2.11 |
Products include Typelevel Fs2.
How do I fix CVE-2022-31183?
Upgrade co.fs2:fs2-io to 3.2.11 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-31183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31183 exists.
Sources
Also known as GHSA-2cpx-6pqp-wf35.