Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2020-13956
Date: December 2, 2020
Overview
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.Details
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.PoC Details
Using org.apache.httpcomponents:httpclient:4.5.12.Consider a minimal example of a vulnerable application.
It takes a carefully crafted URI, which otherwise should belong to legitimate.com domain; passes it to the vulnerable `URIUtils.extractHost` function, which returns the host: http://malicious.com:80.
PoC Code
import org.apache.http.HttpHost;
import org.apache.http.client.utils.URIUtils;
import java.net.URI;
import java.net.URISyntaxException;
public class VulnerableExample {
public static void main(String[] args) throws URISyntaxException {
HttpHost host = URIUtils.extractHost(new URI("http://attacker@malicious.com:80@legitimate.com/"));
System.out.println(host); // prints http://malicious.com:80
}
}Affected Environments
4.0-beta1 through 4.5.12 and 5.0-alpha1 through 5.0.2Prevention
Upgrade to version:org.apache.httpcomponents:httpclient:4.5.13
org.apache.httpcomponents:httpclient-osgi:4.5.13
org.apache.httpcomponents.client5:httpclient5:5.0.3
org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3
Language: Java
Good to know:
Cross-Site Scripting (XSS)
CWE-79Insufficient Information
NVD-CWE-noinfo
Upgrade Version
Upgrade to version org.apache.httpcomponents:httpclient:4.5.13;org.apache.httpcomponents:httpclient-osgi:4.5.13;org.apache.httpcomponents.client5:httpclient5:5.0.3;org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3
| Base Score: |
|
|---|---|
| Attack Vector (AV): | Network |
| Attack Complexity (AC): | Low |
| Privileges Required (PR): | None |
| User Interaction (UI): | None |
| Scope (S): | Unchanged |
| Confidentiality (C): | None |
| Integrity (I): | Low |
| Availability (A): | None |
| Base Score: |
|
|---|---|
| Access Vector (AV): | Network |
| Access Complexity (AC): | Low |
| Authentication (AU): | None |
| Confidentiality (C): | None |
| Integrity (I): | Partial |
| Availability (A): | None |
| Additional information: |