Description

The Reclaim node does not validate the Application-Layer Protocol Negotiation (ALPN) extension in the server's ServerHello message. TLS clients and servers use this field to determine what protocol (for example, HTTP/1.1 or HTTP/2) to use.

This value should be validated in tls/src/make-tls-client.ts:

async function processRecord(
  // ...
) {
  // ...
  const hello = await parseServerHello(content)

Impact

If the Reclaim node does not validate the ALPN field, an attacker may be able to use a protocol other than HTTP/1.1, leading to parsing errors or other vulnerabilities.

Recommendations

The Reclaim node should validate the ALPN field in the ServerHello message.

Remediation