Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Reclaim Protocol>Low findings>Improper TLS certificate parsing
GeneralOverview
Findings
Critical (4)
High (2)
Medium (5)
Low (6)XSS via ignored content-disposition headerAddress bar not updated before page loadImproper TLS certificate parsingImproper host validation in QR-code proof requestProduction credentials in Git source repositoriesLack of sufficient claim-parameter validation
Informational (2)
DiscussionSpoofing risk via website data format instabilitySpoofing risk via insecure contains/RegEx checksSensitive data exposure riskUser-phishing riskLack of `postMessage` origin validationProxy/scraping service usageNode centralization risk
Audit ResultsSummary
Category: Coding Mistakes

Improper TLS certificate parsing

Low Severity
Low Impact
Low Likelihood

Description

The @peculiar/x509 library used by the Reclaim TLS library can parse some invalid certificate files as valid. This includes certificates with invalid hostnames and expired certificates.

Impact

The Reclaim client can be communicating with a site that has an invalid certificate. Attackers could attempt an MITM attack and compromise the integrity or confidentiality of the TLS connection.

Recommendations

Additional certificate validation is required, including validation of the hostname and expired date.

Remediation

Zellic © 2025Back to top ↑