Apache HttpClient Vulnerability: Misinterpretation of Malformed URIs
Summary
CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request executio... Affects httpcomponents-client across 2 version ranges.
< 0d3bd38a509e1a0423e41bfd974ca4924e5a7835
< 4.5.13-1
Fixed in 4.5.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library in Java for making HTTP requests. It provides a robust and flexible framework for handling HTTP communication, including support for various protocols, authentication methods, and connection management. However, certain versions of HttpClient are vulnerable to a URI parsing issue that can lead to incorrect target host selection during request execution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-13956, affects Apache HttpClient versions prior to 4.5.13 and 5.0.3. It arises from the library's misinterpretation of malformed authority components in request URIs when processed as java.net.URI objects. This misinterpretation can result in the library selecting an incorrect target host for executing requests, potentially leading to data leakage or unauthorized access to sensitive information. The issue is particularly concerning in scenarios where requests are made to sensitive endpoints, as it can allow attackers to redirect requests to unintended hosts.
How To Fix
Minimum fixed version
4.5.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade httpcomponents-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to sanitize and validate URIs before they are processed by the HttpClient. This can help mitigate the risk of malformed URIs being used in requests.
Conclusion
The CVE-2020-13956 vulnerability in Apache HttpClient poses a significant risk due to its potential to misinterpret malformed URIs, leading to incorrect target host selection. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for httpcomponents-client →
FAQ
Apache HttpClient versions prior to 4.5.13 and 5.0.3 are affected by this vulnerability.
The vulnerability can lead to incorrect target host selection, which may result in data leakage or unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Yes, you can implement input validation to sanitize and validate URIs before they are processed by the HttpClient as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for httpcomponents-client.
