Vulnerabilities > CVE-2021-32755 - Improper Certificate Validation vulnerability in Wire

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

wire

CWE-295

NVD

Published: 2021-07-13

Updated: 2021-07-16

Summary

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.

Vulnerable Configurations

Part	Description	Count
Application	Wire Wire Wire - Wire Wire 1.0.0 Wire Wire 2.2.210 Wire Wire 2.3.211 Wire Wire 2.9.228 Wire Wire 2.9.2644 Wire Wire 2.9.2645 Wire Wire 2.9.2646 Wire Wire 2.9.2647 Wire Wire 2.9.2648 Wire Wire 2.9.2649 Wire Wire 2.10.252 Wire Wire 2.10.2650 Wire Wire 2.10.2651 Wire Wire 2.10.2652 Wire Wire 2.10.2653 Wire Wire 2.10.2654 Wire Wire 2.11.2655 Wire Wire 2.11.2656 Wire Wire 2.11.2657 Wire Wire 2.11.2658 Wire Wire 2.11.2659 Wire Wire 2.11.2660 Wire Wire 2.11.2661 Wire Wire 2.11.2662 Wire Wire 2.11.2663 Wire Wire 2.11.2664 Wire Wire 2.11.2665 Wire Wire 2.11.2666 Wire Wire 2.11.2667 Wire Wire 2.11.2668 Wire Wire 2.11.2669 Wire Wire 2.11.2670 Wire Wire 2.11.2671 Wire Wire 2.11.2672 Wire Wire 2.11.2673 Wire Wire 2.11.2674 Wire Wire 2.11.2675 Wire Wire 2.11.2676 Wire Wire 2.11.2677 Wire Wire 2.11.2678 Wire Wire 2.11.2679 Wire Wire 2.11.2680 Wire Wire 2.11.2681 Wire Wire 2.11.2682 Wire Wire 2.11.2683 Wire Wire 2.11.2684 Wire Wire 2.11.2685 Wire Wire 2.11.2686 Wire Wire 2.11.2687 Wire Wire 2.11.2688 Wire Wire 2.11.2689 Wire Wire 2.11.2690 Wire Wire 2.11.2691 Wire Wire 2.11.2692 Wire Wire 2.11.2693 Wire Wire 2.11.2694 Wire Wire 2.11.2695 Wire Wire 2.11.2696 Wire Wire 2.11.2697 Wire Wire 2.11.2698 Wire Wire 2.11.2699 Wire Wire 2.11.2700 Wire Wire 2.11.2701 Wire Wire 2.11.2702 Wire Wire 2.11.2703 Wire Wire 2.11.2704 Wire Wire 2.11.2705 Wire Wire 2.11.2706 Wire Wire 2.11.2707 Wire Wire 2.11.2708 Wire Wire 2.11.2709 Wire Wire 2.11.2710 Wire Wire 2.11.2711 Wire Wire 2.11.2712 Wire Wire 2.11.2713 Wire Wire 2.11.2714 Wire Wire 2.11.2715 Wire Wire 2.11.2716 Wire Wire 2.11.2717 Wire Wire 2.11.2718 Wire Wire 2.11.2719 Wire Wire 2.11.2720 Wire Wire 2.11.2721 Wire Wire 2.11.2722 Wire Wire 2.11.2723 Wire Wire 2.12.263 Wire Wire 2.12.264 Wire Wire 2.12.2725 Wire Wire 2.12.2726 Wire Wire 2.12.2727 Wire Wire 2.12.2728 Wire Wire 2.12.2729 Wire Wire 2.13.265 Wire Wire 2.13.2724 Wire Wire 2.13.2730 Wire Wire 2.13.2731 Wire Wire 2.13.2732 Wire Wire 2.13.2733 Wire Wire 2.13.2734 Wire Wire 2.13.2735 Wire Wire 2.13.2736 Wire Wire 2.13.2737 Wire Wire 2.13.2738 Wire Wire 2.13.2739 Wire Wire 2.13.2740 Wire Wire 2.13.2741 Wire Wire 2.13.2742 Wire Wire 2.14.275 Wire Wire 2.14.2743 Wire Wire 2.14.2744 Wire Wire 2.15.279 Wire Wire 2.15.2745 Wire Wire 2.15.2746 Wire Wire 2.15.2747 Wire Wire 2.15.2748 Wire Wire 2.15.2749 Wire Wire 2.15.2750 Wire Wire 2.15.2751 Wire Wire 2.16.282 Wire Wire 2.16.2806 Wire Wire 2.17.568 Wire Wire 2.17.2808 Wire Wire 2.17.2813 Wire Wire 2.18.288 Wire Wire 2.19.289 Wire Wire 2.20.293 Wire Wire 2.21.295 Wire Wire 2.22.297 Wire Wire 2.22.298 Wire Wire 2.27.314 Wire Wire 2.29.318 Wire Wire 2.30.321 Wire Wire 2.31.324 Wire Wire 2.31.325 Wire Wire 2.32.326 Wire Wire 2.32.327 Wire Wire 2.32.330 Wire Wire 2.33.333 Wire Wire 2.33.335 Wire Wire 2.34.338 Wire Wire 2.35.339 Wire Wire 2.35.340 Wire Wire 2.36.342 Wire Wire 2.36.343 Wire Wire 2.37.349 Wire Wire 2.38.351 Wire Wire 2.38.352 Wire Wire 2.39.353 Wire Wire 2.39.354 Wire Wire 2.40.357 Wire Wire 2.41.359 Wire Wire 2.42.364 Wire Wire 3.0.2814 Wire Wire 3.0.2816 Wire Wire 3.0.2828 Wire Wire 3.1.2822 Wire Wire 3.2.2840 Wire Wire 3.2.2860 Wire Wire 3.3.2862 Wire Wire 3.3.2868 Wire Wire 3.3.2872 Wire Wire 3.4.2879 Wire Wire 3.4.2883 Wire Wire 3.4.2885 Wire Wire 3.4.2890 Wire Wire 3.5.888 Wire Wire 3.5.2881 Wire Wire 3.5.2899 Wire Wire 3.5.2910 Wire Wire 3.6.2885 Wire Wire 3.6.2908 Wire Wire 3.6.2923 Wire Wire 3.7.2891 Wire Wire 3.7.2917 Wire Wire 3.7.2930 Wire Wire 3.8.2894 Wire Wire 3.8.2927 Wire Wire 3.8.2940 Wire Wire 3.9.2895 Wire Wire 3.9.2928 Wire Wire 3.9.2943 Wire Wire 3.10.2904 Wire Wire 3.10.3133 Wire Wire 3.10.3138 Wire Wire 3.10.3215 Wire Wire 3.11.2912 Wire Wire 3.11.3259 Wire Wire 3.12.2916 Wire Wire 3.12.3423 Wire Wire 3.12.3490 Wire Wire 3.15.2922 Wire Wire 3.15.3551 Wire Wire 3.15.3621 Wire Wire 3.16 Wire Wire 3.16.2923 Wire Wire 3.16.3562 Wire Wire 3.16.3630 Wire Wire 3.17 Wire Wire 3.17.2924 Wire Wire 3.17.3598 Wire Wire 3.17.3666 Wire Wire 3.18 Wire Wire 3.18.2925 Wire Wire 3.18.3660 Wire Wire 3.18.3728 Wire Wire 3.19 Wire Wire 3.19.2928 Wire Wire 3.19.3731 Wire Wire 3.19.3799 Wire Wire 3.20 Wire Wire 3.20.2934 Wire Wire 3.20.3890 Wire Wire 3.20.3912 Wire Wire 3.21 Wire Wire 3.21.2936 Wire Wire 3.21.3932 Wire Wire 3.21.3959 Wire Wire 3.22 Wire Wire 3.22.3993 Wire Wire 3.23 Wire Wire 3.23.4018 Wire Wire 3.24 Wire Wire 3.24.684 Wire Wire 3.24.4036 Wire Wire 3.25 Wire Wire 3.25.685 Wire Wire 3.25.4071 Wire Wire 3.26 Wire Wire 3.26.4124 Wire Wire 3.27 Wire Wire 3.27.697 Wire Wire 3.27.4223 Wire Wire 3.28 Wire Wire 3.28.1 Wire Wire 3.28.4253 Wire Wire 3.29 Wire Wire 3.29.4330 Wire Wire 3.29.4349 Wire Wire 3.30 Wire Wire 3.31 Wire Wire 3.32 Wire Wire 3.33 Wire Wire 3.33.1 Wire Wire 3.34 Wire Wire 3.35 Wire Wire 3.35.814 Wire Wire 3.36 Wire Wire 3.36.819 Wire Wire 3.37 Wire Wire 3.37.820 Wire Wire 3.37.3113 Wire Wire 3.38 Wire Wire 3.39 Wire Wire 3.40 Wire Wire 3.41 Wire Wire 3.42 Wire Wire 3.42.863 Wire Wire 3.43 Wire Wire 3.44 Wire Wire 3.45 Wire Wire 3.46 Wire Wire 3.47 Wire Wire 3.47.911 Wire Wire 3.48 Wire Wire 3.48.915 Wire Wire 3.49 Wire Wire 3.49.918 Wire Wire 3.49.921 Wire Wire 3.50 Wire Wire 3.51 Wire Wire 3.52 Wire Wire 3.53 Wire Wire 3.54 Wire Wire 3.55 Wire Wire 3.56 Wire Wire 3.57 Wire Wire 3.57.948 Wire Wire 3.58 Wire Wire 3.59 Wire Wire 3.59.959 Wire Wire 3.60 Wire Wire 3.61 Wire Wire 3.61.964 Wire Wire 3.61.965 Wire Wire 3.62 Wire Wire 3.63 Wire Wire 3.63.974 Wire Wire 3.64 Wire Wire 3.65 Wire Wire 3.66 Wire Wire 3.66.985 Wire Wire 3.67 Wire Wire 3.68 Wire Wire 3.69 Wire Wire 3.70 Wire Wire 3.71 Wire Wire 3.72 Wire Wire 3.73 Wire Wire 3.74 Wire Wire 3.75 Wire Wire 3.76 Wire Wire 3.77 Wire Wire 3.80 Wire Wire 3.81 Wire Wire 3.82 Wire Wire 3.83	402
OS	Apple Apple Iphone OS *	1

Common Weakness Enumeration (CWE)

CWE-295 - Improper Certificate Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Creating a Rogue Certificate Authority Certificate
An attacker exploits a weakness in the MD5 hash algorithm (weak collision resistance) to generate a certificate signing request (CSR) that contains collision blocks in the "to be signed" part. The attacker specially crafts two different, but valid X.509 certificates that when hashed with the MD5 algorithm would yield the same value. The attacker then sends the CSR for one of the certificates to the Certification Authority which uses the MD5 hashing algorithm. That request is completely valid and the Certificate Authority issues an X.509 certificate to the attacker which is signed with its private key. An attacker then takes that signed blob and inserts it into another X.509 certificate that the attacker generated. Due to the MD5 collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the attackers' second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority. To make the attack more interesting, the second certificate could be not just a regular certificate, but rather itself a signing certificate. Thus the attacker is able to start their own Certification Authority that is anchored in its root of trust in the legitimate Certification Authority that has signed the attackers' first X.509 certificate. If the original Certificate Authority was accepted by default by browsers, so will now the Certificate Authority set up by the attacker and of course any certificates that it signs. So the attacker is now able to generate any SSL certificates to impersonate any web server, and the user's browser will not issue any warning to the victim. This can be used to compromise HTTPS communications and other types of systems where PKI and X.509 certificates may be used (e.g., VPN, IPSec) .

References

https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-v8mx-h3vj-w39v