CVE-2020-15133: 
Ruby vulnerability analysis and mitigation

The vulnerability (CVE-2020-15133) affects the Faye::WebSocket::Client class in faye-websocket versions prior to 0.11.0. The issue stems from the library's implementation of TLS handshake using EventMachine's EM::Connection#start_tls method, which by default does not verify server certificates for WebSocket Secure (wss:) connections (GitHub Advisory).

The vulnerability occurs because the library does not implement certificate verification by default when establishing wss: connections. When using EM::Connection#start_tls method in EventMachine, the system fails to verify both the validity of the server's TLS certificate chain and the hostname matching for the presented certificate. This implementation gap exists despite EventMachine providing an extension point called ssl_verify_peer for certificate verification (Blog Post).

Any wss: connection made using this library is vulnerable to man-in-the-middle attacks since it does not confirm the identity of the server it is connected to. This means an attacker could potentially intercept and manipulate the secure WebSocket communications between the client and server (GitHub Advisory).

The vulnerability is highly exploitable in environments where an attacker can position themselves between the client and server. The lack of certificate verification means that any self-signed or invalid certificate would be accepted by the client, making it straightforward for an attacker to impersonate the legitimate server (Blog Post).

The vulnerability was patched in version 0.11.0 of faye-websocket. The fix implements proper TLS verification by default and adds two new configuration options: tls.root_cert_file for specifying custom root certificates, and tls.verify_peer for controlling verification behavior. Users should upgrade to version 0.11.0 or later. There are no workarounds for earlier versions as the ssl_verify_peer implementation is required at the library level (GitHub Advisory).