Three TLS Bugs in GoAhead

Three critical vulnerabilities have been discovered in GoAhead, an embedded web server used in hundreds of millions of IoT, firewall, OT, and military devices. These bugs affect GoAhead's TLS integrations and could lead to serious security issues.

The first bug impacts devices using the OpenSSL-compatible backend and running GoAhead versions 3.4.5 through 6.1.0. It allows revoked client certificates to be accepted, even when issuer verification is enabled. The OpenSSL backend loads the configured Certificate Revocation List (CRL) but does not enforce revocation checking. Without CRL or OCSP checking enabled, check_revocation() returns success before verifying the revoked status.

As a result, revoked client certificates can complete the mTLS handshake without being flagged as revoked.

The second bug is specific to the LibreSSL legacy verifier and affects devices running GoAhead versions 3.4.5 through 6.1.0 with the LibreSSL backend. It accepts an over-depth client chain when client certificates are required, bypassing the chain-depth restriction. This allows an attacker to present a certificate chain longer than the allowed limit and still complete the mTLS handshake.

The third bug targets the mbed TLS backend and affects devices running GoAhead versions 4.0.2 through 6.1.0 with TLS 1.2 DHE_RSA suites and a permissive client that accepts broken DH parameters. A buffer-length typo in the mbed TLS code reads only the first byte of the DH modulus instead of the full 256-byte value. This results in only eight possible shared-secret values, which an attacker can try and identify by checking if they decrypt the captured traffic successfully.

If a permissive client does not check the DH parameter size, it can complete a decryptable TLS session, allowing an attacker to decrypt captured sessions and derive the same TLS session keys.