T09 · Insecure Skill Coding Practices
Error
- Location
references/connection-management/connect-with-tls.md:470- Finding
TLS Certificate Validation Bypass
- Content
View full analysis
{ if (errors == SslPolicyErrors.RemoteCertificateChainErrors || errors == SslPolicyErrors.RemoteCertificateNameMismatch) { return true; } ``` ### Technical Analysis The certificate-validation callback explicitly returns `true` when the certificate chain is invalid or when the certificate hostname does not match the requested Tair endpoint. These are critical TLS validation failures that must cause the connection to be rejected. Because the callback immediately accepts these error conditions, the subsequent custom CA validation does not protect those execution paths. An attacker can therefore present an untrusted certificate or a certificate issued for a different hostname and still have it accepted by clients based on this example. ### Attack Path 1. A user implements the documented C# TLS connection example. 2. An attacker gains a network interception position, such as through a compromised proxy, DNS response, gateway, or local network. 3. The attacker redirects the client to an attacker-controlled TLS endpoint. 4. The attacker supplies an invalid-chain certificate or one whose subject does not match the Tair hostname. 5. The callback receives `RemoteCertificateChainErrors` or `RemoteCertificateNameMismatch` and returns `true`. 6. The client establishes the connection and sends Tair authentication credentials and database commands to the attacker-controlled endpoint. 7. The attacker captures credentials and may proxy, inspect, alter, or replay database traffic. ### Impact Assessment Successful exploitation can compromise database credentials, confidentiality, and integrity. The attacker may obtain the permissions associated with the s ...[truncated 129 chars]- Remediation
View remediation