org.asynchttpclient:async-http-client@2.0.0-alpha22

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and NettyRequestSender. An attacker can capture origin credentials by causing a request to an HTTPS origin to be sent through an HTTP proxy, where the client places preemptive Authorization headers on the plaintext CONNECT request. This leaks Basic, Digest, NTLM, SPNEGO, or Kerberos credentials to the proxy and any observer on the client-to-proxy hop, exposing secrets intended only for the origin server.

Workarounds

• Do not use preemptive origin authentication together with an HTTP proxy; disable preemptive origin auth for proxied HTTPS requests so origin Authorization headers are not sent on the plaintext CONNECT to the proxy.
• Reach the origin without a CONNECT proxy; route the request directly to the HTTPS origin so origin credentials are not exposed on the client-to-proxy hop.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through ChannelManager.newHttpContentDecompressor() in client/src/main/java/org/asynchttpclient/netty/channel/ChannelManager.java. An attacker can exhaust the client's heap and trigger an OutOfMemoryError by sending a small gzip, deflate, or snappy response that inflates without limit during automatic decompression. The vulnerable HTTP/1.1 path uses Netty's HttpContentDecompressor with the no-argument constructor, so a hostile or compromised server, or an attacker who can alter a response in transit, can make the client allocate decompressed data until memory is exhausted.

Workarounds

• Disable automatic decompression with setEnableAutomaticDecompression(false) and decompress responses manually with your own size limit; this prevents the HTTP/1.1 client from inflating attacker-controlled bodies without bound.
• On the 2.x line, remove the inflater handler through httpAdditionalChannelInitializer; this prevents the client from installing the unbounded decompressor at all.
• Run the client behind a proxy that caps response sizes; this limits how much compressed data can reach the client and reduces decompression-bomb impact.

Upgrade org.asynchttpclient:async-http-client to version 2.16.1, 3.0.12 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via ThreadSafeCookieStore in ThreadSafeCookieStore.add(...). An attacker can plant a cookie for an unrelated domain by sending a response with a Set-Cookie header whose Domain attribute names a victim domain, causing the client to store that cookie and later send it on requests to the victim site. This affects applications that reuse one AsyncHttpClient cookie jar across attacker-influenced hosts and trusted hosts, such as crawlers, URL fetchers, or redirect-following clients. The result is session fixation or cookie override on the victim domain, so user requests can carry attacker-chosen cookies instead of the intended ones.

Notes

• Applications that share a single CookieStore across both attacker-influenced origins and trusted origins are the exposed deployment pattern; isolated per-trust-domain jars are not affected by this issue.
• The stored cookie is not limited to the response host’s exact name: a response from one host can plant a cookie for an unrelated parent or sibling domain via the Domain attribute, so later requests to that victim domain receive the attacker-chosen value.

Workarounds

• Disable the cookie store by calling setCookieStore(null) when cookies are not needed; this prevents an attacker-influenced host from planting cookies that will later be sent to a trusted domain.
• Use a separate AsyncHttpClient instance, with its own cookie store, for each trust domain; this prevents attacker-controlled hosts and trusted hosts from sharing the same cookie jar.
• If you must keep a shared client, supply a custom CookieStore whose add(Uri, Cookie) rejects cookies whose Domain is not domain-matched by the request host; this blocks unrelated-domain cookies from being stored.

Upgrade org.asynchttpclient:async-http-client to version 2.16.0, 3.0.11 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the propagatedHeaders() method during cross-origin redirects, where Cookie headers are not stripped when forwarding requests to a new origin. An attacker can obtain sensitive session cookies, CSRF tokens, or API keys by leveraging an open redirect, a compromised CDN or API gateway, or a man-in-the-middle attack on a plaintext hop in the redirect chain.

Upgrade org.asynchttpclient:async-http-client to version 2.15.0, 3.0.10 or higher.

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Origin Validation Error in the Redirect30xInterceptor class. An attacker in control of a cross-origin redirect target via a different exploit such as open redirect or DNS rebinding, or who is in a MitM position on HTTP connections, can leak Authorization and Proxy-Authorization headers. This is only exploitable if redirect following is enabled - i.e. followRedirect(true).

Upgrade org.asynchttpclient:async-http-client to version 2.14.5, 3.0.9 or higher.