GoAhead's TLS Backends Harbor Three Bugs That Let Revoked and Decryptable Sessions Through
Three TLS Bugs in GoAhead
GoAhead, the embedded web server running in hundreds of millions of IoT, firewall, and industrial devices, mishandles TLS in three separate ways. Its OpenSSL-compatible backend loads a CRL but never enforces it, silently accepting revoked client certificates (CVSS 9.1). Its Mbed TLS backend truncates a 2048-bit DH modulus to a single byte, leaving eight possible shared secrets an observer can brute-force. And its LibreSSL legacy verifier reports an over-depth chain as a tolerated issuer error. Version 6.1.1 fixes all three.
The broken parameters leave just eight possible shared-secret values: 01, 02, 04, 08, 10, 20, 40 and 80 in hex. An observer can try each candidate and identify the correct one by checking whether it decrypts the captured traffic successfully.