CVE-2019-11284: Insufficiently Protected Credentials in Pivotal Reactor Netty
Summary
CVE-2019-11284: Insufficiently Protected Credentials in Pivotal Reactor Netty. Affects io.projectreactor.netty:reactor-netty versions < 0.8.11. Fixed in 0.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pivotal Reactor Netty is a library used for building reactive network applications in Java. It provides an event-driven, non-blocking I/O model that allows for high-performance and scalable networking. The library is commonly used in web servers and other network communication applications. However, versions prior to 0.8.11 are vulnerable to an issue that allows unauthorized access to credentials when handling redirects. This vulnerability can be exploited by a remote attacker without authentication, potentially leading to unauthorized access to sensitive information on a different server than the attacker has access to.
Vulnerability Detail
The vulnerability in Pivotal Reactor Netty arises from the improper handling of headers during redirects, including authorization headers. When a redirect occurs, the library passes the headers from the original request to the redirected request without proper validation. This means that an attacker can craft a malicious request that triggers a redirect and includes their own authorization headers. As a result, the attacker can gain access to credentials for a different server than they have legitimate access to. This can lead to unauthorized access to sensitive information or even complete compromise of the targeted server.
How To Fix
Minimum fixed version
0.8.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize headers during redirects in their code. This can be done by inspecting the headers received in the redirect response and ensuring that only trusted headers are passed to subsequent requests. However, this workaround may be error-prone and is not a substitute for upgrading to a fixed version of Pivotal Reactor Netty.
Conclusion
In conclusion, the vulnerability in Pivotal Reactor Netty allows unauthorized access to credentials during redirects, potentially leading to unauthorized access to sensitive information or compromise of the targeted server. It is crucial to upgrade to version 0.8.11 or later of the library to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.projectreactor.netty:reactor-netty →
FAQ
Pivotal Reactor Netty is a library used for building reactive network applications in Java. It provides an event-driven, non-blocking I/O model that allows for high-performance and scalable networking.
The vulnerability allows an attacker to gain unauthorized access to credentials for a different server than they have legitimate access to. This can lead to unauthorized access to sensitive information or even complete compromise of the targeted server.
To fix this vulnerability, it is recommended to upgrade to version 0.8.11 or later of Pivotal Reactor Netty. This version includes a fix that properly validates and sanitizes headers during redirects, preventing unauthorized access to credentials.
As a temporary workaround, developers can manually validate and sanitize headers during redirects in their code. However, this workaround may be error-prone and is not a substitute for upgrading to a fixed version of Pivotal Reactor Netty.
There are no known exploits for this vulnerability at this time. However, it is important to address the vulnerability promptly by upgrading to a fixed version of Pivotal Reactor Netty.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.projectreactor.netty:reactor-netty.
