Sensitive Information Exposure in Apache HttpClient 4.x via Proxy-Authorization Header
Summary
CVE-2011-1498: Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive i... Affects httpcomponents-client versions < 4.1.1-1. Fixed in 4.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library in Java for making HTTP requests. It provides a robust and flexible framework for handling HTTP communication, including support for authentication, cookies, and connection management. However, versions prior to 4.1.1 are vulnerable when used with an authenticating proxy server, leading to potential exposure of sensitive information.
Vulnerability Detail
The vulnerability (CVE-2011-1498) arises from the improper handling of the Proxy-Authorization header in Apache HttpClient 4.x before version 4.1.1. When an authenticating proxy server is used, this header is inadvertently sent to the origin server, allowing remote web servers to log and potentially misuse sensitive information contained within the header. This could lead to unauthorized access to user credentials or other confidential data, posing a significant security risk.
How To Fix
Minimum fixed version
4.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade httpcomponents-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to configure your application to avoid sending the Proxy-Authorization header to the origin server. This can be done by modifying the request handling logic to exclude this header when making requests through the proxy.
Conclusion
CVE-2011-1498 highlights a significant vulnerability in Apache HttpClient versions prior to 4.1.1, where sensitive information can be exposed through the Proxy-Authorization header. Upgrading to the latest version is crucial to ensure the security of applications using this library.
See every vulnerability recorded for httpcomponents-client →
FAQ
CVE-2011-1498 is a vulnerability in Apache HttpClient that allows sensitive information to be exposed through the Proxy-Authorization header when used with an authenticating proxy server.
Apache HttpClient versions prior to 4.1.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include unauthorized access to sensitive information, such as user credentials, which could lead to further security breaches.
Yes, you can temporarily mitigate the issue by modifying your application to prevent the Proxy-Authorization header from being sent to the origin server.
Related vulnerabilities
Recent vulnerabilities recorded for httpcomponents-client.
