CVE-2023-41337 h2o vulnerable to TLS session resumption misdirection
A malicious backend can misdirect TLS session resumption to intercept HTTPS traffic if h2o listens on multiple ports with different backends.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-41337?
CVE-2023-41337 is a medium-severity vulnerability in h2o, published on 12 Dec 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportunity to observe or inject packets exchanged between the client and h2o may misdirect HTTPS requests going to other backends and observe the contents of that HTTPS request being sent.
The attack involves a victim client trying to resume a TLS connection and an attacker redirecting the packets to a different address or port than that intended by the client. The attacker must already have been configured by the administrator of h2o to act as a backend to one of the addresses or ports that the h2o instance listens to. Session IDs and tickets generated by h2o are not bound to information specific to the server address, port, or the X.509 certificate, and therefore it is possible for an attacker to force the victim connection to wrongfully resume against a different server address or port on which the same h2o instance is listening.
Once a TLS session is misdirected to resume to a server address / port that is configured to use an attacker-controlled server as the backend, depending on the configuration, HTTPS requests from the victim client may be forwarded to the attacker's server.
An H2O instance is vulnerable to this attack only if the instance is configured to listen to different addresses or ports using the listen directive at the host level and the instance is configured to connect to backend servers managed by multiple entities.
A patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab. As a workaround, one may stop using using host-level listen directives in favor of global-level ones.
Weakness: CWE-347
Which versions are affected by CVE-2023-41337?
It affects 1 product.
Products include Dena H2o.
How do I fix CVE-2023-41337?
No fix has been published for CVE-2023-41337 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41337 being exploited?
There is no known exploitation of CVE-2023-41337 in the wild and no public exploit code.
Other vulnerabilities in h2o
Sources
Also known as DEBIAN-CVE-2023-41337, GHSA-5v5r-rghf-rm6q, UBUNTU-CVE-2023-41337.