Description

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-13T00:17:07.203Z",
  "pubdate": "2026-09-13T00:17:07.203Z",
  "executiveSummary": "Socket Firewall versions prior to 2.0.0 exhibit an insecure default configuration regarding TLS certificate validation. When specific configuration keys (api_ssl_verify and upstream_ssl_verify) are omitted from the socket.yml file, the system defaults to 'false', disabling verification for both API and upstream registry communications. This design flaw allows the OpenResty/Lua HTTP client to accept any TLS certificate, including self-signed or maliciously crafted ones, without validating the chain of trust.\nThe vulnerability exposes the integrity of the firewall's decision-making process and the security of the packages retrieved through the registry. An attacker positioned as a Man-in-the-Middle (MitM) can intercept, inspect, and modify traffic in transit. This enables the substitution of legitimate package content with malicious payloads or the manipulation of allow/block signals sent to the firewall. Because the mechanism lacks verification by default, the system is susceptible to interception attacks without requiring authentication or elevated privileges. Furthermore, versions prior to 1.1.334 suffered from a secondary defect where manual patches were required to facilitate verification due to a missing lua_ssl_trusted_certificate directive in the generated Nginx configuration, rendering the security controls non-functional even when explicitly enabled by administrators.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the outbound HTTP client within the Socket Firewall's registry mode. By defaulting api_ssl_verify and upstream_ssl_verify to 'false' in the generated configuration, the OpenResty/Lua-based HTTP client fails to perform TLS handshake validation against upstream endpoints. This configuration effectively disables the X.509 certificate chain validation, allowing the client to establish a TLS session with any entity presenting a certificate, regardless of its authenticity or origin.\nThe attack vector necessitates a Man-in-the-Middle (MitM) position within the network path between the Socket Firewall instance and the targeted Socket API or upstream package registry. In this position, an attacker can initiate a TLS interception attack. When the firewall attempts to communicate with the registry, the attacker intercepts the request and presents a fraudulent certificate. Because the client does not perform chain validation or verify the server identity, the handshake succeeds.\nOnce the encrypted tunnel is established with the attacker, the attacker gains the capability to decrypt, modify, and re-encrypt the traffic between the firewall and the registry. This facilitates several critical post-exploitation impacts: 1) Response Manipulation: The attacker can modify the metadata or the package binary itself, delivering malicious code to downstream consumers that believe the package has been validated by the firewall. 2) Policy Bypass: The attacker can intercept the API calls used by the firewall to fetch allow/block rules, potentially instructing the firewall to permit prohibited packages or block legitimate ones, thereby undermining the security posture of the entire development environment.\nA secondary technical limitation exists in versions prior to 1.1.334. Even if an administrator sets api_ssl_verify: true and upstream_ssl_verify: true, the generated Nginx configuration failed to output the lua_ssl_trusted_certificate directive. This absence prevented the Lua environment from loading the necessary Certificate Authority (CA) bundle required for successful validation, rendering the enablement of these flags ineffective without manual intervention in the configuration file.\nThis vulnerability persists in all versions of socket-registry-firewall before 2.0.0. The lack of strict verification enables silent, untrusted communication with arbitrary endpoints, significantly increasing the risk of supply chain contamination."
}