OCSP Vulnerability in Nextcloud client
Thu 09 June 2022
Online Certificate Status Protocol (OCSP) is a method for determining the revocation status of a X.509 digital certificate used to authenticate a website, service, or user. Basically, a web browser can, before deciding to use a particular certificate for an encrypted session[1], verify that the certificate is still valid instead of just relying on an expiration date. While many (most?) certificates are good until expiration, one never knows if a certificate gets replaced due to compromise or because the certificate was upgraded. This is why OCSP exists; to provide a mechanism to notify the end-device that the certificate is no longer in use and that it shouldn’t be trusted.
Back in January of 2022, I discovered that Nextcloud client does not check the status of certificates. I was in the process of swapping out some certificates and my computer readily accepted a revoked certificate as trusted. I opened a bug against the product to let the developers know of the issue; it should be a relatively easy fix. Today, five months later, I was told that:
After some discussion and getting a broader picture of the situation and consequences, it was decided that we will not fix this.
So, with that out of the way, I now disclose this to you fine people to do what you will with the information. Hopefully you will not be adversely affected by this bug and I’m not sure exactly how difficult it would be to fix it. If they are simply calling openssl then it’s likely just adding the proper switch. I, unfortunately, have not gotten that far into the issue just yet.
1. Does not always need to be for an encrypted session. Certificates are primarily used for authentication and then can be used to start an encrypted session if there is trust between the user and the certificate.