X.509 certificate trust decided from the subject name
ID |
vbnet.misconfiguration.x509_subject_name_not_validated |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
high |
Remediation Effort |
medium |
Resource |
Misconfiguration |
Language |
VB.NET |
Description
Trust is being decided by comparing the certificate subject name (SubjectName.Name / GetNameInfo) against a fixed string. Subject names are attacker-influenced and easily spoofed, so this is not a valid trust check. Build and validate the full chain instead, e.g. X509Certificate2.Verify() or X509Chain.Build().
Rationale
Trust is being decided by comparing the certificate subject name (SubjectName.Name / GetNameInfo) against a fixed string. Subject names are attacker-influenced and easily spoofed, so this is not a valid trust check. Build and validate the full chain instead, e.g. X509Certificate2.Verify() or X509Chain.Build().
The following code illustrates a vulnerable pattern detected by this rule:
Public Function ValidateByEquals(cert As X509Certificate2) As Boolean
' VULNERABLE: X.509 certificate trust decided from the subject name
If cert.SubjectName.Name = "CN=trusted.example.com" Then
Return True
End If
Return False
End Function