CVE-2012-6153: Apache Commons HttpClient SSL Server Spoofing

Background

Apache Commons HttpClient is a popular Java library used for sending HTTP requests and handling HTTP responses. It provides a comprehensive set of features for interacting with HTTP servers. However, versions prior to 4.2.3 are vulnerable to SSL server spoofing attacks.

Vulnerability Detail

The vulnerability (CVE-2012-6153) exists in the AbstractVerifier class of the Apache Commons HttpClient library. It occurs due to improper verification of the server hostname against the domain name in the X.509 certificate. This allows an attacker to perform a man-in-the-middle attack by presenting a certificate with a subject that specifies a common name in a field other than the CN field. The incomplete fix for CVE-2012-5783 is responsible for this vulnerability. An attacker can exploit this vulnerability to impersonate an SSL server and intercept sensitive information exchanged between the client and the server.

Workaround

If upgrading to a fixed version is not immediately possible, a workaround can be implemented by manually verifying the server's certificate during the SSL handshake. This can be done by implementing a custom X509HostnameVerifier and using it with the HttpClient library. Here's an example of a custom verifier that performs strict hostname verification:

import org.apache.http.conn.ssl.AbstractVerifier;
import javax.net.ssl.SSLException;
import java.security.cert.X509Certificate;

public class StrictHostnameVerifier extends AbstractVerifier {

    @Override
    public void verify(String host, X509Certificate cert) throws SSLException {
        super.verify(host, cert);
        String[] altNames = cert.getSubjectAlternativeNames();
        if (altNames == null || altNames.length == 0) {
            throw new SSLException("No subject alternative names found in the certificate");
        }
        boolean match = false;
        for (String altName : altNames) {
            if (host.equals(altName)) {
                match = true;
                break;
            }
        }
        if (!match) {
            throw new SSLException("Certificate subject does not match the server hostname");
        }
    }

}

To use this custom verifier, set it on the HttpClient's SSL socket factory:

import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.conn.ssl.X509HostnameVerifier;

X509HostnameVerifier verifier = new StrictHostnameVerifier();
SSLSocketFactory socketFactory = new SSLSocketFactory(verifier);
HttpClient httpClient = new DefaultHttpClient();
httpClient.getConnectionManager().getSchemeRegistry().register(new Scheme("https", 443, socketFactory));

This workaround enforces strict hostname verification and mitigates the SSL server spoofing vulnerability.

Conclusion

The SSL server spoofing vulnerability in Apache Commons HttpClient (CVE-2012-6153) can be mitigated by upgrading to version 4.2.3 or later. If immediate upgrade is not possible, implementing a custom hostname verifier can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.httpcomponents:httpclient →

FAQ