asyncHttpClient Cross-Origin Redirect Credential Leak (GHSA-f8m2-889x-wvxx)

Key Vulnerability Information Summary Vulnerability Overview Vulnerability ID: GHSA-f8m2-889x-wvxx Severity: Medium (CVSS 3.0 Score 6.8/10) Vulnerability Type: When a client-configured client-wide realm (set in the config builder, rather than per individual request) is configured, and the client follows a redirect to a different origin, the redirect code strips the per-request realm, but the target server still sends 401 credentials (Basic or OAuth credentials, or Negotiate or NTLM tokens derived from client configuration) to the attacker-controlled origin. This is a residual issue stemming from early cross-origin redirect vulnerabilities. Affected Scope Affected Package: (Maven) Affected Versions: - 3.x: 3.0.9 to 3.0.11 - 2.x: 2.14.5 to 2.16.0 Fixed Versions: - 3.x: 3.0.12 - 2.x: 2.16.1 Remediation Patch: Fixed in 3.0.12 for the 3.x line and 2.16.1 for the 2.x line. The realm is now obtained from the per-request state, which is cleared upon redirection, instead of being re-derived from the client configuration. Workarounds Set the realm on individual requests rather than in the client configuration. Per-request realms are correctly stripped on cross-origin redirects while still allowing authentication for same-origin requests, making this a complete workaround. Disabling follow redirects ( ) is also a workaround: it forces the stripping, but the configuration fallback still re-derives the realm. Related Vulnerabilities This issue bypassed the fixes for the earlier vulnerabilities GHSA-cmvv-58hp-58jg and GHSA-fmzf-7g2p-7g2p, but it is the original vulnerabilities (not this residual issue) that were the primary concerns. Notes When an interceptor reads the realm, if the request's realm is empty, it falls back to the realm from the client configuration (i.e., the realm that was cleared after the redirect stripping).

Goal Reached Thanks to every supporter — we hit 100%!

asyncHttpClient Cross-Origin Redirect Credential Leak (GHSA-f8m2-889x-wvxx)

More from this source