Canary Mail and MailCore2 library missing certificate validation check on IMAP STARTTLS
|Affected Products:||Canary Mail for iOS and MacOS versions 3.20 and 3.21, MailCore2 library version 0.6.4|
|Class:||Improper Certificate Validation (CWE-295)|
|Discovered by:||Rayd Debbas|
CENSUS identified that the Canary Mail software in versions 3.20 and 3.21 (and possibly previous versions) is missing a certificate validation check when performing an IMAP connection configured with STARTTLS. This vulnerability allows man-in-the-middle attackers to collect a victim user's email credentials (while these are communicated to the IMAP service), to access email messages and perform other IMAP actions to the victim account, but also to modify email messages while in-transit to Canary Mail. CENSUS strongly recommends to iOS and MacOS users of the Canary Mail software to update to version 3.22, as this version carries a fix for the aforementioned vulnerability. The same vulnerability also affects other software that are based on the MailCore2 library (including version 0.6.4). A patch for the library is publicly available, however this has not been incorporated yet into an official library release.