Niko/hysteria
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix MITM vulnerability

Browse source 
A malicious actor was capable of intercepting quic traffic between the client
and the server. The attack requires to use certificate pinning with CA-issued certificates.
This commit is contained in:
Valeriy Manzhos 2025-09-25 17:20:17 +03:00
parent 922128e425
commit 9ec5b63386
No known key found for this signature in database
GPG key ID: 6547CFC8E2EC3D90
1 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/cmd/client.go
View file

@ -275,13 +275,12 @@ func (c *clientConfig) fillTLSConfig(hyConfig *client.Config) error {
if c.TLS.PinSHA256 != "" {
nHash := normalizeCertHash(c.TLS.PinSHA256)
hyConfig.TLSConfig.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
for _, cert := range rawCerts {
cert := rawCerts[0] // only check the end-entity cert hash in the chain of trust
hash := sha256.Sum256(cert)
hashHex := hex.EncodeToString(hash[:])
if hashHex == nHash {
return nil
}
}
// No match
return errors.New("no certificate matches the pinned hash")
}