Executive brief
tiny-json-http is a JavaScript HTTP client library used to make API requests over HTTPS. The library disabled SSL certificate validation by default, allowing attackers on the same network to intercept and manipulate encrypted communications without detection. This exposes applications using the library to man-in-the-middle attacks that could lead to data theft or injection of malicious content.
Technical details
The vulnerability is a missing SSL certificate validation flaw (CWE-295) affecting all versions of tiny-json-http from version 1.0.1 through 6.x. The library disabled certificate verification during HTTPS connections and provided no mechanism for users to enable it, leaving applications vulnerable to network-based man-in-the-middle attacks. The attack requires network adjacency (an attacker must be able to intercept traffic between the client and server) but requires no authentication or user interaction. Exploitation allows complete compromise of HTTPS confidentiality and integrity. The issue was fixed in version 7.0.0 with proper certificate validation enabled by default.
Affected products
- Brian LeRoux tiny-json-http 1.0.1 through 6.x
Timeline
- 2018-03-13: disclosed: GHSA published
- 2018-02-15: patched: Fix merged in PR #15
- 2016-10-29: other: Vulnerable code introduced in commit 9b8e74a