Insufficiently Protected Credentials Affecting org.asynchttpclient:async-http-client package, versions [2.14.5,2.16.1)[3.0.9,3.0.12)

org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client (AHC) classes.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm credentials by sending a cross-origin redirect that leads to a 401 response, causing the client to resend a Basic, Digest, Negotiate, or NTLM authentication token to the attacker-controlled origin. The flaw affects clients that configure a Realm on the DefaultAsyncHttpClientConfig.Builder and follow redirects. When a redirect strips the per-exchange realm, the 401 handling path reattaches the config-wide realm and sends credentials to the redirected host instead of keeping them cleared.

Workarounds

• Set the Realm on the individual request instead of on DefaultAsyncHttpClientConfig.Builder/client configuration, so the realm is stripped on a cross-origin redirect and not re-sent to a different-origin 401 target.
• Turn off follow-redirects for requests that would otherwise cross origins, so credentials are not forwarded into a redirect chain that can end at an attacker-controlled 401 response.

• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory