security vulnerability report :- Improper Validation of Certificate

[milanjain7906]

Vulnerability :- Improper Validation of Certificate with Host Mismatch [CWE-297]

Severity :- Medium

Description :- The primary concept of SSL/TLS security is a trust built between the two parties of the intercommunication process: the client and the server, where each party has proven its identity.

Inability to establish a trust relationship due to skipping all necessary verification steps jeopardizes the security of entire client-server communication and introduces an opportunity for the attacker to perform a Man-in-the-Middle (MitM) attack.

As a result, the attacker is able to decrypt and modify all data, transferred via a supposedly encrypted channel.

Improper verification of certificate with host mismatch is a weakness, related to how software treats digital certificate, issued for another domain.

E.g. the application is trying to establish secure communication with the http://www.example.com/website, however, the webserver returns a certificated issued for the www.example.net domain. This certificate can be valid and signed with a trusted CA, but it still should be rejected by the client application.

Step To Reproduce:-

1. first go to the url
2. click on not secure at the url https://wpcom.wp03.runbox.com/
3. now you can see the common name , this certificate issues to this domain which is

wpcom.comingsoon.no

5. that's why this subdomains is fully unsecured

Impact:- The attacker can perform a MitM attack and intercept all communication between your application and the server.

This means that all data transferred via this connection can be decrypted and modified. In the case of a banking app, for example, the attacker might be able to gain full access to the victim’s banking account

[milanjain7906]

Any update team ?