Undertow up to 1.4.18/2.0.1/1.4.23 Digest Authentication Authorization Header improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in Undertow up to 1.4.18/2.0.1/1.4.23. Affected by this vulnerability is an unknown functionality of the component Digest Authentication Handler. This manipulation as part of Authorization Header causes improper authorization. This vulnerability is handled as CVE-2017-12196. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Undertow up to 1.4.18/2.0.1/1.4.23. Affected by this vulnerability is an unknown code of the component Digest Authentication Handler. The manipulation as part of a Authorization Header leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

The bug was discovered 03/29/2018. The weakness was released 04/18/2018 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is known as CVE-2017-12196 since 08/01/2017. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 108324 (RHEL 7 : JBoss EAP (RHSA-2018:0480)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 236672 (Red Hat Update for jboss-ec2-eap package for EAP 7.1.1 (RHSA-2018:0481)).

Upgrading to version 1.4.18.SP1, 2.0.2.Final or 1.4.24.Final eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (108324). Entries connected to this vulnerability are available at VDB-106589, VDB-111708, VDB-112403 and VDB-113195. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Undertow

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20
• 1.4.21
• 1.4.22
• 1.4.23
• 2.0.0
• 2.0.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion