Uniffle HTTP Client Insecure SSL Configuration Vulnerability

A vulnerability exists in the Uniffle HTTP client prior to version 0.10.0, where the client is set to trust all SSL certificates and disables hostname verification by default. This misconfiguration creates a potential Man-in-the-Middle (MITM) attack vector, compromising REST API communications between the Uniffle CLI/client and the Uniffle Coordinator service.

Impact

Exploitation of this vulnerability could lead to Man-in-the-Middle (MITM) attacks, allowing an attacker to intercept and potentially alter communications between the Uniffle CLI/client and the Uniffle Coordinator service.

Remediation

Users are advised to upgrade to Uniffle version 0.10.0 or later, which addresses this vulnerability.