Executive brief
Socket Firewall is a package security gateway used to block malicious or policy-violating packages at the registry level. In versions before 2.0.0, TLS certificate verification is disabled by default for both the Socket API and upstream package registries. An attacker positioned on the network between the firewall and its upstream sources can intercept traffic, present a forged certificate, and inject malicious package content or alter security decisions, leading to compromise of the organization's package supply chain.
Technical details
Socket Firewall's registry mode, when configured without explicit api_ssl_verify and upstream_ssl_verify keys in socket.yml, defaults to disabling TLS certificate verification. The OpenResty/Lua HTTP client used for outbound connections to the Socket API and upstream registries accepts any certificate, including self-signed and untrusted certificates, without validating the certificate chain. An attacker with network access (man-in-the-middle) can present a forged certificate and modify package responses in transit or alter allow/block decisions. Even when verification is explicitly enabled in versions before 1.1.334, the generated nginx configuration lacked the lua_ssl_trusted_certificate directive, preventing verification from functioning. Version 2.0.0 changes the defaults to true and includes proper certificate configuration.
Affected products
- Socket Socket Firewall before 2.0.0
Timeline
- 2026-09-13: disclosed
- 2026-09-13: patched: Version 2.0.0 changes defaults to api_ssl_verify: true and upstream_ssl_verify: true