Missing TLS certificate verification in Faye

CVE-2020-15134 describes a missing TLS certificate verification vulnerability in Faye, a WebSocket client library for Ruby, before version 1.4.0. The root cause is that Faye's Ruby client relies on EM::Connection#start_tls from EventMachine, which does not perform certificate validation by default. This lack of verification means that when a wss: or https: connection is made, the client does not confirm that the server presents a valid and trusted TLS certificate for the expected hostname [1][2].

To exploit this vulnerability, an attacker must be able to perform a man-in-the-middle (MITM) attack on the network path between the Faye client and the server. No authentication is required, as the attack is on the transport layer. The initial request from a Faye client uses plain HTTP, and subsequent messages may use WebSockets, meaning both the initial and future connections are vulnerable unless both em-http-request and faye-websocket implement verification [3][4].

The impact is that an attacker can intercept, read, or modify sensitive data transmitted over what should be a secure encrypted channel. This includes WebSocket messages and HTTPS traffic, potentially compromising the confidentiality and integrity of all communications [2][4].

Faye v1.4.0, released on 2020-07-31, fixes the issue by enabling TLS certificate verification by default in its faye-websocket library. Users are strongly advised to update to this version. For those using em-http-request, version 1.1.6 includes a fix but leaves verification off by default; users must enable the :verify_peer option in their code [1][4].