CVE-2025-70058 Overview
An Improper Certificate Validation vulnerability (CWE-295) has been identified in YMFE YApi version 1.12.0. The application disables TLS/SSL certificate validation by setting rejectUnauthorized: false in the HTTPS agent configuration for Axios requests. This insecure configuration allows the application to accept any SSL/TLS certificate, including self-signed, expired, or maliciously crafted certificates, potentially enabling man-in-the-middle (MITM) attacks.
Critical Impact
Attackers on the network path can intercept, read, and modify sensitive API data transmitted between YApi and external services, compromising data confidentiality and integrity.
Affected Products
- YMFE YApi version 1.12.0
Discovery Timeline
- 2026-02-23 - CVE-2025-70058 published to NVD
- 2026-02-26 - Last updated in NVD database
Technical Details for CVE-2025-70058
Vulnerability Analysis
This vulnerability stems from a fundamental misconfiguration in how YMFE YApi handles HTTPS connections. YApi is an API management platform that facilitates API documentation, testing, and mock services. When making outbound HTTPS requests via Axios, the application explicitly disables certificate validation by configuring the HTTPS agent with rejectUnauthorized: false.
By disabling certificate validation, the application will accept any certificate presented during the TLS handshake, regardless of whether it is signed by a trusted Certificate Authority, has expired, or does not match the expected hostname. This creates a significant security gap that attackers can exploit to perform man-in-the-middle attacks.
The network-based attack vector means that an attacker positioned between the YApi instance and its target servers (such as through ARP spoofing, DNS hijacking, or compromised network infrastructure) can intercept all HTTPS traffic. Despite the connection appearing secure to users, the attacker can decrypt, inspect, and modify data in transit.
Root Cause
The root cause is the explicit disabling of TLS/SSL certificate validation in the Axios HTTP client configuration. The rejectUnauthorized: false setting in the HTTPS agent bypasses all certificate chain validation, hostname verification, and expiration checks. This is commonly done as a shortcut during development to handle self-signed certificates but should never be deployed in production environments.
Attack Vector
The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker must be positioned to intercept network traffic between the YApi server and external API endpoints. Once in position, the attacker can:
- Present a fraudulent certificate to the YApi instance during the TLS handshake
- Establish a separate legitimate connection to the intended destination server
- Relay and potentially modify traffic between both endpoints
- Capture sensitive data including API keys, authentication tokens, and business-critical information
The attack mechanism exploits the disabled certificate validation in YApi's Axios configuration. When the application makes HTTPS requests to external services, it fails to verify that the presented certificate is legitimate. Technical details regarding the vulnerable code configuration can be found in the GitHub Gist documentation.
Detection Methods for CVE-2025-70058
Indicators of Compromise
- Unexpected certificate warnings or errors in connected client applications while YApi continues to function normally
- Network traffic analysis revealing TLS connections with invalid or self-signed certificates being accepted
- Discrepancies between API responses received by YApi and actual responses from legitimate API endpoints
- Presence of unknown intermediate proxies in network traffic logs
Detection Strategies
- Audit the YApi configuration and source code for instances of rejectUnauthorized: false in HTTPS agent settings
- Monitor network traffic for TLS connections that accept certificates not issued by trusted Certificate Authorities
- Implement network intrusion detection rules to identify potential MITM attack patterns
- Review Axios and HTTPS agent configurations across all Node.js applications in the environment
Monitoring Recommendations
- Deploy network monitoring to detect certificate anomalies in outbound HTTPS connections from YApi instances
- Implement certificate pinning validation at the network perimeter where possible
- Enable verbose logging for all outbound API requests from YApi to identify suspicious activity
- Use SentinelOne Singularity Platform to monitor for unauthorized network interception tools and MITM attack indicators
How to Mitigate CVE-2025-70058
Immediate Actions Required
- Remove or set rejectUnauthorized: true in all HTTPS agent configurations within YApi
- Audit all Node.js applications for similar insecure TLS configurations
- Implement proper certificate management for any self-signed certificates required in development environments
- Consider network segmentation to limit exposure of YApi instances to untrusted networks
Patch Information
No official vendor patch has been identified at the time of publication. Organizations should review the YMFE YApi GitHub repository for updates and security advisories. Manual remediation of the configuration is recommended until an official fix is released.
Workarounds
- Modify the Axios HTTPS agent configuration to enable proper certificate validation by setting rejectUnauthorized: true
- Use environment-specific configurations to ensure development shortcuts are not deployed to production
- Implement certificate pinning for critical external API connections
- Deploy a reverse proxy with proper TLS termination and certificate validation in front of YApi
# Configuration example - Verify and update Node.js HTTPS agent settings
# Locate Axios configuration files and ensure proper certificate validation
grep -r "rejectUnauthorized" /path/to/yapi/
# Update any instances of rejectUnauthorized: false to rejectUnauthorized: true
# Or remove the setting entirely to use secure defaults
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
