CWE-295: TLS verification disabled in http_gets() — VERIFYPEER+VERIFYHOST false, TLSv1 only (crypto exchange)

[LeoWSY-hashblue]

Summary

run.php's http_gets() function unconditionally disables both CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST for any HTTPS URL. The function handles wallet sync, transaction processing, and ETH block scanning. Also downgrades to TLSv1 (CWE-327).

Vulnerable Code (run.php:6-12)

function http_gets($url){
    $oCurl = curl_init();
    if(stripos($url,"https://")!==FALSE){
        curl_setopt($oCurl, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($oCurl, CURLOPT_SSL_VERIFYHOST, FALSE);
        curl_setopt($oCurl, CURLOPT_SSLVERSION, 1); // TLSv1
    }
}

Impact

Any deployment using HTTPS exposes wallet sync, transaction processing, and market data to MITM interception.

Fix

curl_setopt($oCurl, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($oCurl, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($oCurl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);

Note

Project last updated September 2019.

Severity

CVSS 7.4 (HIGH) — CWE-295 + CWE-327