CyberRota Analysis
AI-GeneratedVersions of s2s-proxy up to 0.2.2 are vulnerable due to improper TLS client certificate verification, allowing attackers to exploit the system using self-signed certificates. This critical vulnerability enables unauthorized access to RPCs permitted by the proxy's configuration and Temporal credentials, posing significant risks to data integrity and confidentiality. Organizations utilizing s2s-proxy should prioritize immediate remediation to safeguard their systems against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.