Insecure Certificate Verification in Async Http Client (CVE-2013-7397)
Summary
CVE-2013-7397: Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to... Affects async-http-client versions < 1.6.5-3. Fixed in 1.6.5-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Async Http Client (AHC) is a popular library used for making asynchronous HTTP requests in Java applications. It is designed to provide a non-blocking API for handling HTTP requests and responses, making it suitable for high-performance applications. However, prior to version 1.9.0, AHC had a critical vulnerability that allowed man-in-the-middle attacks due to improper handling of X.509 certificate verification.
Vulnerability Detail
The vulnerability arises from the fact that Async Http Client skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set. This oversight allows attackers to spoof HTTPS servers by presenting arbitrary certificates, potentially leading to data interception or manipulation during secure communications. The issue is particularly concerning in typical configurations where client certificates are not sent, making it easier for attackers to exploit the vulnerability.
How To Fix
Minimum fixed version
1.6.5-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade async-http-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually set up a keyStore and trustStore in your application configuration. Here is an example of how to set these properties in Java:
System.setProperty("javax.net.ssl.keyStore", "/path/to/keystore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "your_keystore_password");
System.setProperty("javax.net.ssl.trustStore", "/path/to/truststore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "your_truststore_password");
Conclusion
CVE-2013-7397 is a significant vulnerability in Async Http Client that can lead to serious security risks if not addressed. Users are advised to upgrade to the latest version and configure their keyStore and trustStore properly to mitigate the risk of man-in-the-middle attacks.
See every vulnerability recorded for async-http-client →
FAQ
CVE-2013-7397 is a vulnerability in Async Http Client that allows man-in-the-middle attacks due to improper X.509 certificate verification.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to data interception, manipulation, and unauthorized access to sensitive information during HTTPS communications.
Versions of Async Http Client prior to 1.9.0 are affected by this vulnerability.
Upgrade to Async Http Client version 1.9.0 or later, and ensure that both keyStore and trustStore are configured correctly.
Related vulnerabilities
Recent vulnerabilities recorded for async-http-client.
