PT-2024-9750 · Unknown+1 · Async Http Client+1

Pickypg · Published 2024-06-18 · Updated 2024-12-08 · CVE-2024-53990

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.1

Description The AsyncHttpClient library has an issue where the automatically enabled and self-managed CookieStore silently replaces explicitly defined Cookies with any that have the same name from the cookie jar. This can result in one user's Cookie being used for another user's requests in services that operate with multiple users. The vulnerability can lead to unauthorized access to protected information.

Recommendations For versions prior to 3.0.1, upgrade to version 3.0.1 to mitigate the risks. As a temporary workaround, consider disabling the CookieStore during client creation by setting the cookie store to null, for example:

DefaultAsyncHttpClientConfig.Builder clientBuilder = Dsl.config()
 .setCookieStore(null)
 // other configuration
 ;```

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-11486

CVE-2024-53990

GHSA-MFJ5-CF8G-G2FV

Affected Products

Async Http Client

Debian

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53990.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53990 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53990 · Security Note
• https://osv.dev/vulnerability/GHSA-mfj5-cf8g-g2fv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53990 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53990 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11486 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53990 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-53990 · Vendor Advisory
• https://github.com/AsyncHttpClient/async-http-client/issues/1964 · Note
• https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-mfj5-cf8g-g2fv · Note
• https://github.com/AsyncHttpClient/async-http-client/commit/d5a83362f7aed81b93ebca559746ac9be0f95425 · Note
• https://github.com/AsyncHttpClient/async-http-client/pull/2033 · Note
• https://github.com/AsyncHttpClient/async-http-client · Note