CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
Attackers can hijack user sessions because the library silently replaces explicit cookies with those from the shared cookie jar.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53990?
CVE-2024-53990 is a critical authentication bypass vulnerability in AsyncHttpClient async-http-client, published on 2 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.
Weakness: CWE-287
Which versions are affected by CVE-2024-53990?
4 open source packages ship an affected version, including org.asynchttpclient:async-http-client.
| Package | Affected | Fixed in |
|---|---|---|
org.asynchttpclient:async-http-client Maven | From 2.1.0 | 2.12.4 |
org.asynchttpclient:async-http-client Maven | From 2.1.0 | 2.12.4 |
org.asynchttpclient:async-http-client Maven | From 3.0.0.Beta1 | 3.0.1 |
org.asynchttpclient:async-http-client Maven | From 3.0.0.Beta1 | 3.0.1 |
How do I fix CVE-2024-53990?
Upgrade org.asynchttpclient:async-http-client to a fixed version for your release line: 2.12.4 or 3.0.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-53990 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53990 exists.
Sources
Also known as DEBIAN-CVE-2024-53990, GHSA-mfj5-cf8g-g2fv, MINI-82f8-rc8h-58m5, MINI-q6c5-4j5r-qhvh, UBUNTU-CVE-2024-53990.