Critical Cookie Management Flaw in AsyncHttpClient Library
Summary
UBUNTU-CVE-2024-53990: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Affects async-http-client versions 1.6.5-1 – 1.6.5-2ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AsyncHttpClient (AHC) library is a popular Java library designed to facilitate the execution of HTTP requests and the asynchronous processing of HTTP responses. It is widely used in applications that require efficient and non-blocking communication with web services. The library's key features include support for both synchronous and asynchronous requests, a user-friendly API, and built-in cookie management. However, a recent vulnerability has been identified that compromises the integrity of cookie handling, potentially leading to unauthorized access to user sessions.
Vulnerability Detail
The vulnerability arises from the library's self-managed CookieStore, which automatically replaces explicitly defined cookies with those from the cookie jar if they share the same name. This behavior can lead to a scenario where one user's cookies are inadvertently used for another user's requests, posing a significant security risk in multi-user environments. The vulnerability is classified under CVE-2024-53990 and has a CVSS score of 4.0, indicating a medium severity level. Attackers could exploit this flaw to hijack user sessions, leading to unauthorized access and data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually manage cookies by disabling the automatic cookie management feature of the AsyncHttpClient library. This can be done by creating a custom CookieStore and setting it explicitly in the client configuration. Example code:
import org.asynchttpclient.DefaultAsyncHttpClient;
import org.asynchttpclient.AsyncHttpClient;
import org.asynchttpclient.cookie.CookieStore;
CookieStore customCookieStore = new CustomCookieStore(); AsyncHttpClient client = new DefaultAsyncHttpClient();
client.setCookieStore(customCookieStore);
Conclusion
The AsyncHttpClient library has a critical vulnerability that affects cookie management, posing a risk of session hijacking. It is essential for developers using this library to update to the latest patched version to mitigate the risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for async-http-client →
FAQ
CVE-2024-53990 is a vulnerability in the AsyncHttpClient library that allows for cookie management issues, potentially leading to session hijacking.
If your application uses the AsyncHttpClient library, this vulnerability could allow unauthorized users to access other users' sessions, compromising security.
The affected versions include AsyncHttpClient 1.6.5-2ubuntu0.1~esm1, 1.6.5-4, 1.6.5-5, 2.6.0-1, and 2.12.3-1 across various Ubuntu distributions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Yes, there are patched versions available. Updating to the latest version of AsyncHttpClient will resolve the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for async-http-client.
