Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(connector-fabric): mandate ssh host key verification #663

Open
petermetz opened this issue Mar 12, 2021 · 0 comments
Open

fix(connector-fabric): mandate ssh host key verification #663

petermetz opened this issue Mar 12, 2021 · 0 comments
Labels
bug Something isn't working Fabric good-first-issue Good for newcomers Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. Security Related to existing or potential security vulnerabilities

Comments

@petermetz
Copy link
Member

Describe the bug

The Fabric connector does not support host key verification at the moment while connecting to a server to deploy contracts.
This is a security hole that needs to be plugged so that production deployments don't have to wonder if they are being MITM'd while deploying new contracts.

To Reproduce

Try to MITM someone who is doing a Fabric contract deployment and observe that you can do it because there was no host key verification. Oops.

Expected behavior

MITM attempt should fail as long as you do not have complete access to the target machine.

Logs/Stack traces

N/A

Screenshots

N/A

Cloud provider or hardware configuration:

Everywhere.

Operating system name, version, build:

Everywhere

Hyperledger Cactus release version or commit (git rev-parse --short HEAD):

0.4.0

Hyperledger Cactus Plugins/Connectors Used

Fabric

Additional context

https://www.ssh.com/attack/man-in-the-middle

cc: @takeutak @sfuji822 @hartm @jonathan-m-hamilton @AzaharaC @jordigiam @kikoncuo

@petermetz petermetz added bug Something isn't working Fabric good-first-issue Good for newcomers Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. Security Related to existing or potential security vulnerabilities labels Mar 12, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Fabric good-first-issue Good for newcomers Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. Security Related to existing or potential security vulnerabilities
Projects
None yet
Development

No branches or pull requests

1 participant