CVE-2024-39689

What it actually does

The certifi library, a core component for TLS certificate validation in the Python ecosystem, includes root certificates from the 'GLOBALTRUST' Certificate Authority (CA). This CA has been deemed untrustworthy due to unresolved compliance issues, leading to its removal from major trust stores. Applications using vulnerable versions of certifi will incorrectly trust TLS certificates issued by this CA, enabling an attacker with such a certificate to successfully impersonate a legitimate server, thereby breaking the integrity and authenticity of the TLS connection.

Why it matters to the business

Applications relying on outdated versions of this library are susceptible to Man-in-the-Middle (MitM) attacks, where attackers can impersonate legitimate services to intercept, read, or alter sensitive data in transit. This could lead to the theft of customer data, financial credentials, or internal secrets, resulting in significant financial loss, regulatory fines, and severe reputational damage. Given that certifi is a foundational dependency for countless other libraries (e.g., 'requests'), the vulnerability's reach is extensive, potentially affecting a wide array of web clients, APIs, and internal tools.

How an attack unfolds

An attacker first obtains a TLS certificate from the now-distrusted 'GLOBALTRUST' CA. They then position themselves between a client application and a legitimate server, typically through techniques like DNS poisoning or by controlling a network segment (e.g., public Wi-Fi). When the client, using a vulnerable version of certifi, attempts to connect to the legitimate service, the attacker intercepts the request and presents their malicious server secured with the 'GLOBALTRUST' certificate. The client's certifi library, trusting the 'GLOBALTRUST' root, validates the certificate and establishes a supposedly secure connection with the attacker. The attacker now has full control over the communication channel, allowing them to decrypt traffic, steal credentials, or inject malicious content.

How to fix it

Update the 'certifi' package to version 2024.07.04 or later. This can be accomplished using the standard Python package manager with the command: `pip install --upgrade certifi`. Ensure that all Python environments, virtual environments, container images, and serverless function dependencies are updated. After updating, redeploy any applications that bundle or depend on the certifi library.

How to confirm the fix worked

To verify that the vulnerability has been remediated, check the installed version of the certifi package in your environment. Run `pip show certifi` or `pip list | grep certifi` and confirm that the version is 2024.07.04 or newer. As a functional test, you can inspect the library's certificate bundle (typically `cacert.pem`) to confirm that certificates with 'GLOBALTRUST' in their issuer name have been removed.

Typical attack path

1. Attacker obtains a TLS certificate chaining up to a distrusted 'GLOBALTRUST' root.
2. Attacker gains a Man-in-the-Middle (MitM) position on the network between a victim client and a target server.
3. The victim's application, using a vulnerable version of the certifi library, initiates a connection to the target server.
4. The attacker intercepts the TLS handshake and presents their malicious certificate.
5. The vulnerable client library validates and trusts the attacker's certificate, establishing a connection to the attacker's server.
6. The attacker intercepts and manipulates the communication, potentially stealing sensitive data like credentials or session tokens.

How to detect it

Detecting past exploitation is challenging as it would appear as valid TLS traffic. Focus on analyzing historical network data. Review TLS inspection logs, proxy logs, or network flow data for successful connections where the server certificate's issuer chain contains 'GLOBALTRUST'. Correlate these connections with sensitive endpoints to assess potential data exposure. Proactively, monitor Certificate Transparency (CT) logs for any new certificates being issued by 'GLOBALTRUST' that target your domains.

• TLS certificate issuer containing the string 'GLOBALTRUST'

What your security team should do

• Immediately use a Software Composition Analysis (SCA) tool to identify all instances of the 'certifi' library, including as a transitive dependency, across all codebases and deployed applications.
• Prioritize patching all affected systems by upgrading 'certifi' to version 2024.07.04 or later, focusing first on production and internet-facing applications.
• Update base container images and CI/CD pipeline configurations to ensure all future builds and deployments use the patched version of the library by default.