Description

buildFactory() selects the trust-all path with no conditional or configuration gate:

Main.java:125-131

private KonnektorConnectionFactory buildFactory(Config cfg) {
    return KonnektorConnectionFactoryBuilder.newBuilder()
        .clientKeys(cfg.clientKeys())
        .konnektorUri(cfg.konnektorUri())
        .proxyServer(cfg.proxyAddress(), cfg.proxyPort())
        .trustAllServers() // currently we don't validate the server's certificate
        .build();
}

View source →

.trustAllServers() installs NaiveTrustManager, whose checkServerTrusted() is an empty method that accepts any certificate:

NaiveTrustManager.java:8-28

public class NaiveTrustManager implements X509TrustManager {
  @Override
  public void checkServerTrusted(X509Certificate[] chain, String authType) {
      // we're naive, let's just trust everything
  }
}

View source →

Hostname verification is also turned off, at KonnektorConnectionFactoryImpl.java:158 (tlsParams.setDisableCNCheck(true)). The builder method behind .trustAllServers() carries a /** DO NOT USE IN PRODUCTION! */ Javadoc, so the production entry point reaches the trust-all manager through a method explicitly marked not for production, with no alternative path in the reviewed code.

Impact

An attacker on the network segment between the ePA service and the Konnektor (the healthcare facility's LAN, a VPN transit hop, or TI network infrastructure) presents a self-signed certificate for any hostname; the client accepts it and the connection is established.

The intercepted SOAP exchange carries patient identifiers (KVNR), SMC-B card operations (authentication and signing), document content, and credential exchanges. The attacker can read and tamper with all of it.

Mitigation

Update epa4all-client to 1.2.2 or later. The fix replaces .trustAllServers() with a properly configured TrustManager that validates the Konnektor's certificate, and removes the setDisableCNCheck(true) hostname-check override. The Konnektor certificate must be validated against the appropriate trust anchor (the Konnektor's CA, which may be operator-specific) with the hostname check left on; do not fall back to the system default trust store alone.

Defender's Checklist

Update epa4all-client to 1.2.2 or later.

All versions before 1.2.2 are affected. The fix is pull request #36.

Confirm trustAllServers() is gone from the production path.

Check that the production entry point no longer calls .trustAllServers() and that NaiveTrustManager is not installed. The method behind it is Javadoc-marked not for production.

Verify the hostname check is on.

Confirm setDisableCNCheck(true) is removed so the Konnektor certificate's CN/SAN must match the expected hostname.

Validate against the correct trust anchor.

The Konnektor certificate must chain to its appropriate CA. Bind that trust store to the connection rather than disabling validation; a self-signed or operator-specific Konnektor certificate is handled with a dedicated trust store, not a trust-all manager.

Severity Reasoning

AV:AThe attacker must sit on the network segment between the ePA service and the Konnektor, an adjacent-network position such as the facility LAN or a VPN transit hop.AC:LAny self-signed certificate is accepted; no timing or environmental conditions.PR:NNo credentials required beyond the network position.UI:NThe REST service opens the Konnektor connection on its own; no user interaction.S:UImpact is bounded to the SOAP traffic between the service and the Konnektor.C:HPlaintext access to KVNRs, SMC-B operations, document content, and credentials on the intercepted connection.I:HThe attacker can modify SOAP requests and responses in both directions, including signing operations and document content.A:NNo availability impact.

TLS Certificate Validation Disabled in Production

Description

Impact

Mitigation

Defender's Checklist

Severity Reasoning

References

How We Can Help

Who We Are

Dr. rer. nat. Simon Weber

Dipl.-Inf. Volker Schönefeld

Looking for a Penetration Test?