CWE-299 is the failure to check, or to check correctly, whether a certificate has been revoked. The product may then trust a certificate that has been compromised.
MITRE ranks this as a far more serious flaw than related certificate failures. The most common reason to revoke a certificate is that the system holding the key was compromised, so legitimate servers will not be using a revoked certificate unless they are badly out of sync. Seeing one in use is almost certainly malicious.
How it happens
Revocation is an extra step on top of normal validation. A client has to fetch a Certificate Revocation List (CRL) or otherwise learn the status, and many implementations skip it, check only the leaf, or treat a failed lookup as a pass.
MITRE's observed examples:
- CVE-2011-2014: an LDAP-over-SSL implementation does not check the CRL, allowing spoofing with a revoked certificate.
- CVE-2011-0199: an operating system does not check the CRL in some cases.
- CVE-2010-5185: an antivirus product does not check whether certificates from signed executables have been revoked.
- CVE-2009-3046: a web browser does not check whether any intermediate certificates are revoked.
Note the intermediate case: revocation has to be considered along the whole chain, not only for the server certificate.
What an attacker gains
Trust may be given to an entity that is not who it claims to be. Data from an untrusted and possibly malicious source may be accepted, and data may be disclosed to an entity impersonating a trusted one.
How to find it
Static analysis can find some instances in source or compiled code. For a behavioral test, obtain a certificate from a test CA, revoke it, publish the CRL, and see whether your client still connects. Also test what happens when the revocation source is unreachable, since the failure mode you choose (fail open or fail closed) is a policy decision that should be made on purpose.
How to fix it
- Ensure certificates are checked for revoked status, as MITRE says.
- Check every certificate in the chain, not just the leaf.
- Decide your policy for unreachable revocation data and document it.
- If you pin certificates, validate all relevant properties before pinning, including revoked status.
Quick check
Why is a revoked certificate worse than an expired one?
Expiry is routine and often an oversight. Revocation is deliberate, usually after a compromise, so a revoked certificate showing up is a strong sign of an attack.
