Mozilla Foundation Security Advisory 2015-13
Appended period to hostnames can bypass HPKP and HSTS protections
- Announced
- February 24, 2015
- Reporter
- Muneaki Nishimura
- Impact
- Moderate
- Products
- Firefox, Firefox OS, SeaMonkey
- Fixed in
-
- Firefox 36
- Firefox OS 2.2
- SeaMonkey 2.33
Description
Security researcher Muneaki Nishimura reported that when certificate pinning is set to "strict" mode, a period ('.') appended to a hostname in the address of a site allowed the bypass key pinning (HPKP) and HTTP Strict Transport Security (HSTS). Sites with a period appended were treated as having a different origin than sites without the period. If an attacker had a security certificate for a domain with the added period, this would allow for a Man-in-the-middle (MITM) attack on users.