Erlang/OTP Distribution-over-TLS LAN Allowlist Silent Bypass

Vulnerability Overview Title: Distribution-over-TLS LAN Allowlist is Silently Bypassed Description: When Erlang distribution uses TLS, the kernel's flag is used to enforce that connected nodes are on the same LAN. However, the function calls in to obtain the peer IP address, instead of the correct . This means that and are always identical (both are local addresses), so the LAN subnet mask comparison always passes. The undocumented safety net—which is intended to restrict distribution connections to the local subnet—is completely ineffective for TLS distribution. Scope of Impact Affected Versions: - OTP: >= 26.0 - ssl (OTP): >= 11.0 Fixed Versions: - OTP: 29.0.2, 28.5.0.2, 27.3.4.13 - ssl (OTP): 11.7.2, 11.6.0.2, 11.2.12.9 Remediation Correct Implementation: - Use correctly in and to obtain the peer IP. POC Code Trigger Conditions 1. Erlang distribution is configured to use TLS ( ). 2. The kernel environment variable is set to . 3. TLS verification in the cluster accepts certificates not limited to cluster members—i.e., the CA is shared with other services (web servers, VPNs, other teams). If the cluster uses a dedicated CA that only signs cluster node certificates, certificate verification alone restricts access, making ineffective when functioning correctly. 4. The attacker holds a valid certificate signed by the same CA (even if legitimate—for example, they run other services—or obtained via leakage from a non-cluster certificate holder). Workarounds Implement the option: to perform the check correctly. Affected/Unaffected Versions Versions greater than or equal to one of the listed fixed versions are unaffected; otherwise, versions that satisfy the affected version expression are affected, and if they do not satisfy it, they are unaffected. The documentation for the OTP version scheme describes how to compare versions. Note that the version scheme used prior to OTP 17.0 was never fixed when the new OTP version scheme was introduced, because it did not clearly define how to compare those older versions. The vulnerability was introduced in OTP 26.0 (ssl 11.0). OTP versions earlier than 26.0 did not implement this functionality.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP Distribution-over-TLS LAN Allowlist Silent Bypass

More from this source