Insufficiently Protected Credentials Affecting org.asynchttpclient:async-http-client package, versions [,2.16.1)[3.0.0.Beta1,3.0.12)

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and NettyRequestSender. An attacker can capture origin credentials by causing a request to an HTTPS origin to be sent through an HTTP proxy, where the client places preemptive Authorization headers on the plaintext CONNECT request. This leaks Basic, Digest, NTLM, SPNEGO, or Kerberos credentials to the proxy and any observer on the client-to-proxy hop, exposing secrets intended only for the origin server.

Workarounds

• Do not use preemptive origin authentication together with an HTTP proxy; disable preemptive origin auth for proxied HTTPS requests so origin Authorization headers are not sent on the plaintext CONNECT to the proxy.
• Reach the origin without a CONNECT proxy; route the request directly to the HTTPS origin so origin credentials are not exposed on the client-to-proxy hop.

• GitHub Commit
• GitHub Commit async-http-client-project-3.0.12
• GitHub PR
• Maintainer's Advisory