Xray-core concealed a certificate verification bypass vulnerability
Xray-core maintainers allegedly concealed a certificate verification bypass vulnerability for six months, silently patching it without a security advisory while criticizing other software for poor security practices.
read it The detailed disclosure provides crucial security warnings for operators of Xray-core, exposing questionable maintainer practices and unpatched risks.
summary
The maintainers of the proxy software Xray-core removed a secure certificate-pinning option and replaced it with a flawed alternative that bypassed regular certificate verification. When a researcher discovered that an attacker could inject leaf certificates to exploit this flaw, the maintainers silently patched it without a security advisory. The vulnerability remained undisclosed for nearly half a year until the reporter published a GitHub issue due to incomplete fixes and ongoing silence.
key points
- Xray-core replaced the secure pinnedPeerCertificateChainSha256 option with a flawed pinnedPeerCertSha256 feature that always skipped regular certificate verification.
- An attacker could insert a malicious leaf certificate anywhere in the chain to successfully bypass custom pinning logic and execute man-in-the-middle attacks.
- Maintainers silently patched the bug under the guise of simplifying the code and refused to issue a security advisory or notify users.
who should read it
Network engineers, security researchers, and operators using Xray-core for proxying and censorship circumvention.
discussion hostile
consensus
Commenters condemn the maintainers' failure to issue a security advisory, noting that silent patches leave users dangerously in the dark. Others discuss Xray's widespread use in heavily censored regions like Russia and China.
Fixing the code is only half of incident response. Without an advisory, affected-version range, and downstream notification, users cannot know whether they remain exposed.
It succinctly captures the core issue with the maintainers' response: fixing code without an incident advisory leaves downstream users vulnerable.
Generated by an LLM from the article and thread. Check the sources before relying on it.