fix(internal-plugin-encryption): fail closed on KMS x5c chain validation (FPV-531)

docs/samples/calling/app.js

@@ -283,7 +283,6 @@ async function initCalling(e) {
         kmsInitialTimeout: 8000,
         kmsMaxTimeout: 40000,
         batcherMaxCalls: 30,
-        caroots: null,
       },
       dss: {},
     },

packages/@webex/internal-plugin-encryption/src/config.js

@@ -2,8 +2,38 @@
  * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
  */
 
+import {has} from 'lodash';
+
+import DEFAULT_KMS_CAROOTS from './kms-default-caroots';
+
+/**
+ * lodash merge combines arrays by index, so an explicit encryption.caroots
+ * override (including []) would otherwise retain default root entries.
+ *
+ * @param {Object} webexConfig merged webex config object
+ * @param {Object} [overrideConfig] config passed to initialize/setConfig
+ * @returns {void}
+ */
+export function applyEncryptionConfigOverrides(webexConfig, overrideConfig = {}) {
+  if (!webexConfig?.encryption) {
+    return;
+  }
+
+  if (has(overrideConfig, 'encryption.caroots')) {
+    webexConfig.encryption.caroots = overrideConfig.encryption.caroots;
+  }
+}
+
 export default {
   encryption: {
+    /**
+     * PEM (base64 DER) encoded CA certificates trusted to sign the KMS
+     * static-key certificate chain. KMS validation fails closed when this
+     * list is empty; deployments MUST provide the Webex KMS issuing roots.
+     * @type {Array<string>}
+     */
+    caroots: DEFAULT_KMS_CAROOTS,
+
     joseOptions: {
       compact: true,
       contentAlg: 'A256GCM',

packages/@webex/internal-plugin-encryption/src/index.js

@@ -12,11 +12,11 @@ import '@webex/internal-plugin-device';
 
 import '@webex/internal-plugin-mercury';
 
-import {registerInternalPlugin} from '@webex/webex-core';
+import WebexCore, {registerInternalPlugin} from '@webex/webex-core';
 import {has, isObject, isString} from 'lodash';
 
 import Encryption from './encryption';
-import config from './config';
+import config, {applyEncryptionConfigOverrides} from './config';
 import {DryError} from './kms-errors';
 
 import KmsDryErrorInterceptor from './kms-dry-error-interceptor';
@@ -29,6 +29,30 @@ if (process.env.NODE_ENV === 'test') {
   };
 }
 
+let encryptionConfigNormalizationInstalled = false;
+
+function installEncryptionConfigNormalization() {
+  if (encryptionConfigNormalizationInstalled) {
+    return;
+  }
+
+  encryptionConfigNormalizationInstalled = true;
+
+  const {initialize, setConfig} = WebexCore.prototype;
+
+  WebexCore.prototype.initialize = function initializeWithEncryptionConfig(attrs = {}) {
+    initialize.call(this, attrs);
+    applyEncryptionConfigOverrides(this.config, attrs.config);
+  };
+
+  WebexCore.prototype.setConfig = function setConfigWithEncryptionConfig(newConfig = {}) {
+    setConfig.call(this, newConfig);
+    applyEncryptionConfigOverrides(this.config, newConfig);
+  };
+}
+
+installEncryptionConfigNormalization();
+
 registerInternalPlugin('encryption', Encryption, {
   payloadTransformer: {
     predicates: [

packages/@webex/internal-plugin-encryption/src/kms-certificate-validation.js

@@ -221,12 +221,14 @@ const validateKMS =
       validateCommonName(certificates, jwt);
       validatePublicCertificate(certificates, jwt);
 
-      // Skip validating signatures if no CA roots were provided
-      const promise = caroots
-        ? validateCertificatesSignature(certificates, caroots)
-        : Promise.resolve();
+      // Fail closed: without trusted CA roots the x5c chain cannot be
+      // authenticated, and an attacker-supplied self-signed certificate
+      // would satisfy every other check above.
+      if (!isArray(caroots) || caroots.length === 0) {
+        throwError('no trusted CA roots configured; cannot validate KMS certificate chain');
+      }
 
-      return promise.then(() => jwt);
+      return validateCertificatesSignature(certificates, caroots).then(() => jwt);
     });
 
 export default validateKMS;

packages/@webex/internal-plugin-encryption/test/unit/spec/encryption-config.js

@@ -0,0 +1,39 @@
+import {assert} from '@webex/test-helper-chai';
+import {cloneDeep, merge} from 'lodash';
+
+import defaultConfig, {applyEncryptionConfigOverrides} from '../../../src/config';
+
+describe('internal-plugin-encryption', () => {
+  describe('encryption config', () => {
+    it('replaces caroots when consumer supplies an empty array', () => {
+      const webexConfig = merge({}, defaultConfig, {encryption: {caroots: []}});
+
+      assert.isAbove(webexConfig.encryption.caroots.length, 0);
+
+      applyEncryptionConfigOverrides(webexConfig, {encryption: {caroots: []}});
+
+      assert.deepEqual(webexConfig.encryption.caroots, []);
+    });
+
+    it('replaces caroots when consumer supplies a single custom root', () => {
+      const customRoot = 'CUSTOM_CA_ROOT';
+      const webexConfig = merge({}, defaultConfig, {encryption: {caroots: [customRoot]}});
+
+      assert.isAbove(webexConfig.encryption.caroots.length, 1);
+      assert.include(webexConfig.encryption.caroots, customRoot);
+
+      applyEncryptionConfigOverrides(webexConfig, {encryption: {caroots: [customRoot]}});
+
+      assert.deepEqual(webexConfig.encryption.caroots, [customRoot]);
+    });
+
+    it('leaves default caroots when consumer does not override caroots', () => {
+      const webexConfig = merge({}, defaultConfig, {encryption: {kmsInitialTimeout: 1000}});
+      const expectedCaroots = cloneDeep(webexConfig.encryption.caroots);
+
+      applyEncryptionConfigOverrides(webexConfig, {encryption: {kmsInitialTimeout: 1000}});
+
+      assert.deepEqual(webexConfig.encryption.caroots, expectedCaroots);
+    });
+  });
+});

packages/@webex/internal-plugin-encryption/test/unit/spec/kms-certificate-validation.js

@@ -1,5 +1,6 @@
 import {assert} from '@webex/test-helper-chai';
 
+import config from '../../../src/config';
 import validateCert, {KMSError, validateCommonName, X509_SUBJECT_ALT_NAME_KEY} from '../../../src/kms-certificate-validation';
 
 const caroots = [
@@ -152,14 +153,29 @@ describe('internal-plugin-encryption', () => {
       return assert.isRejected(validate(jwt), KMSError);
     });
 
-    it('accepts self signed certificate if no CA roots.', () => {
+    it('rejects self-signed certificate when no CA roots are configured', () => {
       const jwt = {
         ...VALID_JWT,
         x5c: x5cSelfSigned,
         n: x5cSelfSignedModulus,
       };
 
-      return validateCert()(jwt).then((results) => assert.equal(results, jwt));
+      return assert.isRejected(validateCert([])(jwt), KMSError);
+    });
+
+    it('rejects self-signed certificate with default config caroots', () => {
+      const jwt = {
+        ...VALID_JWT,
+        x5c: x5cSelfSigned,
+        n: x5cSelfSignedModulus,
+      };
+
+      return assert.isRejected(validateCert(config.encryption.caroots)(jwt), KMSError);
+    });
+
+    it('ships default trusted CA roots in encryption config', () => {
+      assert.isArray(config.encryption.caroots);
+      assert.isAbove(config.encryption.caroots.length, 0);
     });
   });
 });