CVE-2018-14642: Information Leak Vulnerability in Undertow

Background

Undertow is a lightweight web server written in Java that is used to handle HTTP and WebSocket requests. It is commonly used in Java-based web applications. The vulnerability identified as CVE-2018-14642 allows an unauthorized actor to access sensitive information due to an information leak in Undertow. This vulnerability affects versions of the 'io.undertow:undertow-core' package up to and including 2.0.18.FINAL.

Vulnerability Detail

The vulnerability arises from a flaw in the code that handles flushing the buffer in Undertow. If all headers are not written out in the first write() call, the buffer flushing code will write out the full contents of the buffer, which may include data from previous requests. This can lead to the exposure of sensitive information to an unauthorized actor. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-200.

Workaround

If upgrading to a fixed version is not immediately feasible, a possible workaround is to ensure that all headers are written out in the first write() call. This can be achieved by carefully managing the order and timing of header writes in the code. Here is an example of how to ensure all headers are written in a single call:

HttpServerExchange exchange = ...;
exchange.getResponseHeaders().put(Headers.CONTENT_TYPE, "application/json");
exchange.getResponseHeaders().put(Headers.SERVER, "Undertow");
exchange.getResponseHeaders().put(Headers.CACHE_CONTROL, "no-store");
exchange.getResponseHeaders().put(Headers.PRAGMA, "no-cache");
exchange.getResponseSender().send("Hello, World!");

By setting all the required headers before calling send(), the vulnerability can be mitigated.

Conclusion

In conclusion, the vulnerability identified as CVE-2018-14642 in Undertow can lead to the exposure of sensitive information to unauthorized actors. It is recommended to upgrade to a fixed version of the 'io.undertow:undertow-core' package or apply the suggested workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for io.undertow:undertow-core →

FAQ