datatheorem / datatheorem/TrustKit-Android

Uploading report fails with: javax.net.ssl.SSLHandshakeException: Pin verification failed

Open
#72 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
604
Forks
90
Avg merge
1h 29m
Merged PRs (30d)
2

Description

Describe the bug
Uploading report would fail with "Pin verification failed" if report-uri has same domain as the domain for which the pinning failed. This is most likely case for an organization.

To Reproduce
In the TrustKit sample app, www.google.com is configured with invalid pins. So pinning would fail. If the report-uri is also set to www.google.com, it would fail to upload report with javax.net.ssl.SSLHandshakeException: Pin verification failed.
Tested this on Android version 10. This issue should be reproduced on Android version 7 and above.

Expected behavior
We should be successfully able to upload reports without applying the pinning.

TrustKit configuration
Copy and paste your XML Network Security Policy.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config>
        <domain includeSubdomains="true">www.datatheorem.com</domain>
        <!-- Valid pins -->
        <pin-set expiration="2018-01-01">
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <pin digest="SHA-256">YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=</pin>
        </pin-set>
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <report-uri>https://overmind.datatheorem.com/trustkit/report</report-uri>
        </trustkit-config>
    </domain-config>
    <domain-config enforcePinning="true">
        <domain includeSubdomains="true">www.google.com</domain>
        <pin-set>
            <!-- Invalid pins -->
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
        </pin-set>
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <report-uri>https://www.google.com</report-uri>
        </trustkit-config>
    </domain-config>
    <domain-config enforcePinning="false">
        <domain includeSubdomains="true">localhost</domain>
        <trustkit-config
          enforcePinning="false"
          disableDefaultReportUri="true" />
    </domain-config>
</network-security-config>

App details:
TrustKit Demo app
Tested this on Android version 10. This issue should be reproduced on Android version 7 and above.

Additional context
Note that, I tested failure with invalid pin approach. I suppose results would be similar for MITM attack as well?
Is it expected to apply pining for report upload as well? If so wouldn't it obviously fail?
May be I am missing something here. Please let me know.
Thanks.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the TrustKit sample app configuration in the issue and trace the report upload path when report-uri uses the same domain as a pinned endpoint. Reproduce the failure on Android 7 or later, then verify that reports upload successfully without applying the failing pinning configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.