Critical Hostname Verification Bypass in Apache HttpClient 4.3.x
Summary
CVE-2013-4366: http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname veri... Affects httpcomponents-client versions < 4.3.2-1. Fixed in 4.3.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library for making HTTP requests in Java applications. It provides a robust and flexible framework for handling HTTP connections, including support for various authentication schemes, connection management, and cookie handling. However, versions 4.3.x before 4.3.1 are vulnerable to a critical issue where the X509HostnameVerifier is not properly validated, potentially allowing attackers to exploit hostname verification weaknesses.
Vulnerability Detail
The vulnerability identified as CVE-2013-4366 arises from a failure in the HttpClientBuilder.java file of Apache HttpClient 4.3.x prior to version 4.3.1. Specifically, the code does not ensure that the X509HostnameVerifier is not null, which can lead to unspecified impacts through improper hostname verification. This flaw can be exploited by attackers to impersonate legitimate servers, intercept sensitive data, or perform man-in-the-middle attacks, thereby compromising the integrity and confidentiality of the communication.
How To Fix
Minimum fixed version
4.3.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade httpcomponents-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing a custom hostname verifier that checks for null values before proceeding with verification. Here is a sample code snippet to illustrate this workaround:
import org.apache.http.conn.ssl.X509HostnameVerifier;
X509HostnameVerifier customVerifier = new X509HostnameVerifier() { @Override public void verify(String host, SSLSocket ssl) throws IOException {
if (host == null) {
throw new IOException("Hostname verifier cannot be null");
}
// Implement additional verification logic here
}
// Implement other required methods
};
Conclusion
CVE-2013-4366 presents a significant security risk for applications using Apache HttpClient 4.3.x prior to version 4.3.1. It is crucial for developers to upgrade to a patched version to protect against potential attacks that exploit hostname verification weaknesses. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for httpcomponents-client →
FAQ
CVE-2013-4366 is a vulnerability in Apache HttpClient 4.3.x that allows attackers to bypass hostname verification due to a null check on the X509HostnameVerifier.
Exploitation of this vulnerability can lead to man-in-the-middle attacks, where an attacker can intercept and manipulate data between your application and a legitimate server.
Apache HttpClient versions 4.3.x prior to 4.3.1 are affected by this vulnerability.
The recommended action is to upgrade to Apache HttpClient version 4.3.2-1 or later to ensure proper hostname verification.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for httpcomponents-client.
