Abstract:
Modern web servers support the use of TLS session resumption and client authentication. If the web server is configured with virtual hosting, the server must be able to separate the sessions and client certificates between the different virtual hosts. If the server fails to do so, an attacker could gain unauthorized access. Our study probes web servers’ behavior for inconsistencies and vulnerabilities when the three features interact. We design and implement an automated test framework. We find that the servers do not always behave according to the TLS and HTTP standards. We show differences between the servers in how they handle client authentication and session resumption and discuss the implications. Namely, we discover a security vulnerability in the Caddy web server.