AHC v2.16.1 Multiple Vulnerabilities Overview: CVE Write-up and Patch Details

Vulnerability Overview In AHC v2.16.1, multiple security vulnerabilities exist, primarily involving WebSocket proxy credentials, HTTP/1.1 response decompression, client-scoped credentials, Cookie domain attributes, replay attacks, digest authentication, URL userinfo credentials, WebSocket handshake, connection pool reuse, and SOCKS proxy credentials. Impact Scope WebSocket Proxy Credentials: WebSocket proxy credentials are sent to the origin server through the CONNECT tunnel. HTTP/1.1 Response Decompression: Unbounded HTTP/1.1 response decompression leads to denial-of-service attacks. Client-Scoped Credentials: Client-scoped credentials are re-sent to cross-origin redirect targets. Cookie Domain Attribute: The Cookie domain attribute is not checked against the public suffix list, allowing the setting of suffixes such as . Replay Attack: Replay attacks send the origin host's requests and credentials to a new host. Digest Authentication: Digest authentication is generated using a non-encrypted random source. URL Userinfo Credentials: URL userinfo credentials are sent through the HTTP proxy. WebSocket Handshake: The WebSocket handshake continues even after the check fails. Connection Pool Reuse: Connection pool reuse of NTLM or Negotiate connections leads to authentication issues. SOCKS Proxy Credentials: SOCKS proxy credentials are sent in plaintext over HTTP. Remediation WebSocket Proxy Credentials: Ensure secure transmission of WebSocket proxy credentials. HTTP/1.1 Response Decompression: Limit HTTP/1.1 response decompression to prevent denial-of-service attacks. Client-Scoped Credentials: Prevent client-scoped credentials from being re-sent to cross-origin redirect targets. Cookie Domain Attribute: Validate Cookie domain attributes to prevent the setting of public suffixes. Replay Attack: Prevent replay attacks and ensure the security of requests and credentials. Digest Authentication: Use an encrypted random source to generate digest authentication. URL Userinfo Credentials: Avoid sending URL userinfo credentials through the HTTP proxy. WebSocket Handshake: Terminate the WebSocket handshake if the check fails. Connection Pool Reuse: Avoid reusing connection pools for NTLM or Negotiate connections. SOCKS Proxy Credentials: Avoid sending SOCKS proxy credentials in plaintext over HTTP. Proof of Concept (POC) Code No specific POC code or exploit code was provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

AHC v2.16.1 Multiple Vulnerabilities Overview: CVE Write-up and Patch Details

More from this source