PT-2023-27913 · H2O+1 · H2O+1

Kazuhopublished · Published 2023-12-12 · Updated 2023-12-19 · CVE-2023-41337

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions h2o versions 2.3.0-beta2 and prior

Description The issue involves a malicious backend entity misdirecting HTTPS requests to other backends and observing the contents of the request. This occurs when h2o is configured to listen to multiple addresses or ports with different backend servers managed by multiple entities. The attack involves a victim client trying to resume a TLS connection, and an attacker redirecting the packets to a different address or port. Session IDs and tickets generated by h2o are not bound to specific server addresses, ports, or X.509 certificates, allowing an attacker to force a victim connection to wrongfully resume against a different server address or port.

Recommendations For h2o versions 2.3.0-beta2 and prior, apply the patch available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab to resolve the issue. As a temporary workaround, stop using host-level listen directives in favor of global-level ones to minimize the risk of exploitation.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-41337

GHSA-5V5R-RGHF-RM6Q

Affected Products

Debian

H2O

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41337.json · Exploit
• https://github.com/h2o/h2o/security/advisories/GHSA-5v5r-rghf-rm6q · Vendor Advisory
• https://github.com/h2o/h2o/commit/35760540337a47e5150da0f4a66a609fad2ef0ab · Patch
• https://osv.dev/vulnerability/CVE-2023-41337 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-41337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41337 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41337 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41337 · Security Note
• https://ubuntu.com/security/CVE-2023-41337 · Vendor Advisory
• https://t.me/cvenotify/63341 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734689897477525792 · Twitter Post
• https://twitter.com/CVEnew/status/1734662542067155108 · Twitter Post
• https://t.me/cvenotify/64219 · Telegram Post