Summary
KaringX ClashMi through version 1.0.32.1801 disables TLS certificate validation by default in its HttpUtils helper, allowing HTTPS connections to accept forged certificates. If an attacker controls or operates the user's proxy node, they may intercept update traffic, provide a manipulated manifest, and enable malicious installer execution when the update runs.
KaringX ClashMi through version 1.0.32.1801 disables TLS certificate validation by default in its HttpUtils helper, allowing HTTPS connections to accept forged certificates. If an attacker controls or operates the user's proxy node, they may intercept update traffic, provide a manipulated manifest, and enable malicious installer execution when the update runs.
Affected context
The issue may affect ClashMi deployments that use the vulnerable HttpUtils networking helper with certificate validation disabled by default. Risk is increased when update metadata and installers are retrieved through a proxy or other network path that an attacker can control, and when update manifests do not require cryptographic integrity metadata such as a valid SHA-256 value.
The issue may affect ClashMi deployments that use the vulnerable HttpUtils networking helper with certificate validation disabled by default. Risk is increased when update metadata and installers are retrieved through a proxy or other network path that an attacker can control, and when update manifests do not require cryptographic integrity metadata such as a valid SHA-256 value.
Exploit preconditions
- Attack surface: HTTPS connections used for update manifest or installer retrieval
- Required access: Ability to operate or control the proxy node or network path used by the application
- Trigger point: Update checking and subsequent processing of the returned manifest
- Why exploitation is possible: The client may accept a forged server certificate and a manifest that omits expected integrity information, allowing an attacker-controlled installer to be selected and executed during the update process
- Attack surface: HTTPS connections used for update manifest or installer retrieval
- Required access: Ability to operate or control the proxy node or network path used by the application
- Trigger point: Update checking and subsequent processing of the returned manifest
- Why exploitation is possible: The client may accept a forged server certificate and a manifest that omits expected integrity information, allowing an attacker-controlled installer to be selected and executed during the update process
Why this happens
The underlying bug is improper certificate validation, mapped to CWE-295. The HTTP helper treats a TLS connection as trusted without verifying that the presented certificate chains to an appropriate trusted authority and matches the intended endpoint. Because update integrity checks are also insufficient when the manifest omits a hash, transport interception can extend into unauthorized update content delivery.
The underlying bug is improper certificate validation, mapped to CWE-295. The HTTP helper treats a TLS connection as trusted without verifying that the presented certificate chains to an appropriate trusted authority and matches the intended endpoint. Because update integrity checks are also insufficient when the manifest omits a hash, transport interception can extend into unauthorized update content delivery.
Potential impact
- Attackers may intercept HTTPS update traffic
- Users may receive a forged update manifest or installer
- Malicious installer code may execute with the application's user privileges
- Credentials, configuration data, or locally accessible files could be exposed
- The application or host may be compromised
- Attackers may intercept HTTPS update traffic
- Users may receive a forged update manifest or installer
- Malicious installer code may execute with the application's user privileges
- Credentials, configuration data, or locally accessible files could be exposed
- The application or host may be compromised
General mitigation guidance
Mitigation generally focuses on restoring end-to-end authenticity for network connections and update artifacts.
Common defensive patterns include:
- Enabling strict TLS certificate and hostname validation by default
- Rejecting connections when certificate verification cannot be completed
- Requiring signed update metadata and cryptographically verified installer artifacts
- Treating missing, malformed, or mismatched hashes as validation failures
- Separating update retrieval from execution and applying least-privilege permissions
- Reducing trust in user-controlled proxy settings and monitoring unexpected proxy changes
Mitigation generally focuses on restoring end-to-end authenticity for network connections and update artifacts.
Common defensive patterns include:
- Enabling strict TLS certificate and hostname validation by default
- Rejecting connections when certificate verification cannot be completed
- Requiring signed update metadata and cryptographically verified installer artifacts
- Treating missing, malformed, or mismatched hashes as validation failures
- Separating update retrieval from execution and applying least-privilege permissions
- Reducing trust in user-controlled proxy settings and monitoring unexpected proxy changes
How teams detect issues like this
Detection approaches may include:
- Static analysis for disabled TLS verification, permissive certificate callbacks, and insecure HTTP client defaults
- Code review checks covering certificate-chain validation, hostname verification, and update integrity enforcement
- Tests using invalid, expired, self-signed, and mismatched certificates to confirm connection rejection
- Policy enforcement requiring signed manifests, mandatory hashes, and verified installer provenance
- Network monitoring for unexpected proxy use, certificate changes, or update traffic that lacks integrity metadata
Automated code review and software composition tools may help identify related certificate-validation patterns.
Detection approaches may include:
- Static analysis for disabled TLS verification, permissive certificate callbacks, and insecure HTTP client defaults
- Code review checks covering certificate-chain validation, hostname verification, and update integrity enforcement
- Tests using invalid, expired, self-signed, and mismatched certificates to confirm connection rejection
- Policy enforcement requiring signed manifests, mandatory hashes, and verified installer provenance
- Network monitoring for unexpected proxy use, certificate changes, or update traffic that lacks integrity metadata
Automated code review and software composition tools may help identify related certificate-validation patterns.
