AsyncHttpClient Cookie Tossing Vulnerability (CVE-2020-55688) Fix Guide

Vulnerability Overview Vulnerability Name: Cookie stored for an unrelated domain (cookie tossing) in AsyncHttpClient ThreadSafeCookieStore Vulnerability Type: Cookie injection / Cookie tossing (CWE-1275) Description: allows setting a cookie for a domain without proper validation (RFC 6265 §5.3, step 6). An attacker can inject a cookie intended for an unrelated domain, which the client will subsequently send to that domain. Affected Versions Affected Versions: - (Maven) - >= 3.0.0.Beta1, = 2.0.0, < 2.16.0 Impact Description: - Applications using a single instance (which shares the by default) may inadvertently share cookies between attacker-controlled hosts and trusted hosts. - Typical exposure scenarios include web scrapers, link previews/web scraping, SSRF-like functionalities, multi-backend aggregators, or systems following redirects to attacker-controlled hosts. - An attacker can write cookies to the victim's host (enabling session fixation or overwriting authentication/CSRF tokens), but cannot read cookies belonging to the victim's host. - Applications that only connect to fixed trusted backends, or those that disable/limit cookie storage, are not affected. Remediation Fixed Versions: - 3.0.11 - 2.16.0 Temporary Workarounds: - Disable cookie storage ( ) when it is not needed; - Use separate instances (one per trusted domain); - Provide a custom implementation where the method rejects cookies that do not match the request's host. References Fix: PR #2196 CVSS Score CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: None - Integrity: Low - Availability: None CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N CVE ID: CVE-2020-55688 Weakness: CWE-1275

Goal Reached Thanks to every supporter — we hit 100%!

AsyncHttpClient Cookie Tossing Vulnerability (CVE-2020-55688) Fix Guide

More from this source