Threat Intelligence Database

AsyncHttpClient versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11 contain a vulnerability in the ThreadSafeCookieStore where cookies are stored under their Domain attribute without verifying if the responding host is authorized to set cookies for that domain. This allows an attacker-controlled host to plant cookies scoped to unrelated domains, which the client may send in later requests to those domains. The issue affects applications using a single AsyncHttpClient instance with the default shared CookieStore to access both attacker-influenced and trusted hosts. The vulnerability is fixed in versions 2.16.0 and 3.0.11.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.