Im trying to understand SSL/TLS better but cannot work out if such an attack is prevented.
Lets say you have a file security scanner (S). An application server (A) which consumes (S) accepting a file input.
Assuming the API (S) is using HTTPS is the following MITM/Replay Attack possible?
M —> A -> M -> S
|
S
Where (M) is a malicious actor. (M) first sends a clean file to (S) and then uploads to (A) a virus file, then replays the clean file response from (S) to (A).
Client auth or client certs here would prevent this. But to me it looks like this attack shouldn’t work anyway since (A) would have its own pre-master key which wouldn’t match whatever (M) tried to replay. My understanding is during the handshake the client also generates a random number hence any (M) would need to predict or control that to essentially dupe or replay the response.
Can someone clarify if some further client protection is needed or is HTTPS enough?
