Sensitive Information Exposure in Apache HttpClient 4.x - Proxy-Authorization Header Leak
Summary
DEBIAN-CVE-2011-1498: Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive i... Affects httpcomponents-client versions < 4.1.1-1. Fixed in 4.1.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a popular library used for making HTTP requests in Java applications. It provides a robust and flexible way to interact with web services, handling various aspects of HTTP communication, including authentication, connection management, and response handling. However, versions prior to 4.1.1 have a vulnerability that can expose sensitive information when used with an authenticating proxy server.
Vulnerability Detail
The vulnerability arises from the way Apache HttpClient 4.x handles the Proxy-Authorization header. When an authenticating proxy server is used, the library inadvertently sends this header to the origin server. This behavior can lead to remote web servers logging the Proxy-Authorization header, potentially exposing sensitive credentials or tokens to unauthorized parties. The issue is particularly concerning for applications that rely on proxy servers for authentication, as it can result in data breaches and unauthorized access.
How To Fix
Minimum fixed version
4.1.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade httpcomponents-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, consider configuring your application to avoid sending the Proxy-Authorization header to the origin server. This can be done by modifying your HTTP client configuration to disable proxy authentication or by using a different method for authenticating with the proxy.
Conclusion
The Apache HttpClient vulnerability (CVE-2011-1498) poses a significant risk by exposing sensitive information through the Proxy-Authorization header. It is crucial for users of affected versions to update to version 4.1.1 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for httpcomponents-client →
FAQ
The vulnerability can lead to sensitive information exposure, as the Proxy-Authorization header may contain credentials that can be logged by remote servers.
Apache HttpClient versions prior to 4.1.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider implementing a workaround by disabling proxy authentication or modifying your HTTP client configuration to prevent sending the Proxy-Authorization header.
More information can be found in the CVE details at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-1498.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpcomponents-client.
