REDHAT-BUG-2536969: High severity maven/io.netty/netty-handler-ssl-ocsp vulnerability

Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass

A public GitHub Security Advisory (GHSA-jhjp-5q4f-8wr2) describes the following issue:

Summary Netty's OcspClient does not verify that an OCSP responder certificate contains the id-kp-OCSPSigning Extended Key Usage (EKU). A bad actor with any valid certificate issued by the same CA can forge "GOOD" OCSP responses for revoked certificates, bypassing revocation checks.

Details In io.netty.handler.ssl.ocsp.OcspClient, validateSignature uses CertPathBuilder to validate the responder's certificate chain to the trust anchor. However, it fails to verify if the responder is authorized to sign OCSP responses. Per RFC 6960, delegated OCSP responders must explicitly hold the id-kp-OCSPSigning EKU. Because OcspClient omits this check, any CA-issued certificate can successfully sign forged OCSP responses.

https://datatracker.ietf.org/doc/html/rfc6960#section-4.2.2.2

Systems or applications that rely on OCSP responses MUST be capable of detecting and enforcing the use of the id-kp-OCSPSigning value as described above. ... They MUST reject the response if the certificate required to validate the signature on the response does not meet at least one of the following criteria:

1. Matches a local configuration of OCSP signing authority for the certificate in question, or

2. Is the certificate of the CA that issued the certificate in question, or

3. Includes a value of id-kp-OCSPSigning in an extended key usage extension and is issued by the CA that issued the certificate in question as stated above.

PoC The following test in io.netty.handler.ssl.ocsp.OcspClientTest demonstrates the vulnerability. A bad actor creates a forged OCSP response signed by a standard, non-OCSP-signing certificate. Netty validates the signature without throwing an exception.

java @Test void validateSignatureWithoutEkuSucceedsBypass() throws Exception { X509Bundle caRoot = new CertificateBuilder() .algorithm(CertificateBuilder.Algorithm.rsa2048) .subject("CN=TrustedRootCA") .setIsCertificateAuthority(true) .buildSelfSigned();

X509Bundle badActorCert = new CertificateBuilder() .algorithm(CertificateBuilder.Algorithm.rsa2048) .subject("CN=BadActorServer") .buildIssuedBy(caRoot);

X509CertificateHolder badActorHolder = new JcaX509CertificateHolder(badActorCert.getCertificate());

BasicOCSPResp forgedResponse = createBasicOcspResponse( badActorCert, new X509CertificateHolder[]{badActorHolder} );

assertDoesNotThrow(() -> OcspClient.validateSignature(forgedResponse, caRoot.getCertificate()), "Validation should have thrown an exception due to missing EKU."); }

Impact Authorization Bypass. Applications using Netty's OcspClient will accept revoked certificates if a network-positioned bad actor possesses any other certificate from the same CA.

Affected: - maven:io.netty:netty-handler-ssl-ocsp affected >=4.2.0.Final, <=4.2.17.Final; fixed unknown - maven:io.netty:netty-handler-ssl-ocsp affected >= 4.1.0.Final, <=4.1.137.Final; fixed unknown

Fixed versions: see advisory

Advisory: https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2