Endpoint Vulnerability

Appended period to hostnames can bypass HPKP and HSTS protections

Description

Security researcher Muneaki Nishimura reported that when certificate pinning is set to 'strict' mode, a period ('.') appended to a hostname in the address of a site allowed the bypass key pinning (HPKP) and HTTP Strict Transport Security (HSTS). Sites with a period appended were treated as having a different origin than sites without the period. If an attacker had a security certificate for a domain with the added period, this would allow for a Man-in-the-middle (MITM) attack on users.

Affected Products

Firefox

References

CVE-2015-0832,