CVE-2023-41337: h2o vulnerable to TLS session resumption misdirection
First published: Tue Dec 12 2023(Updated: )
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportunity to observe or inject packets exchanged between the client and h2o may misdirect HTTPS requests going to other backends and observe the contents of that HTTPS request being sent. The attack involves a victim client trying to resume a TLS connection and an attacker redirecting the packets to a different address or port than that intended by the client. The attacker must already have been configured by the administrator of h2o to act as a backend to one of the addresses or ports that the h2o instance listens to. Session IDs and tickets generated by h2o are not bound to information specific to the server address, port, or the X.509 certificate, and therefore it is possible for an attacker to force the victim connection to wrongfully resume against a different server address or port on which the same h2o instance is listening. Once a TLS session is misdirected to resume to a server address / port that is configured to use an attacker-controlled server as the backend, depending on the configuration, HTTPS requests from the victim client may be forwarded to the attacker's server. An H2O instance is vulnerable to this attack only if the instance is configured to listen to different addresses or ports using the listen directive at the host level and the instance is configured to connect to backend servers managed by multiple entities. A patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab. As a workaround, one may stop using using host-level listen directives in favor of global-level ones.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dena H20 | <=2.2.6 | |
| Dena H20 | =2.3.0-beta1 | |
| Dena H20 | =2.3.0-beta2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-41337?
CVE-2023-41337 has not been assigned a specific CVSS score, but it is considered a critical vulnerability due to improper backend server management.
How do I fix CVE-2023-41337?
To fix CVE-2023-41337, upgrade h2o to version 2.3.0 or later, ensuring proper configuration of backend servers.
What versions are affected by CVE-2023-41337?
CVE-2023-41337 affects h2o version 2.3.0-beta2 and prior versions up to 2.2.6.
What type of vulnerability is CVE-2023-41337?
CVE-2023-41337 is a configuration vulnerability that occurs when multiple backend servers are incorrectly managed.
Who is impacted by CVE-2023-41337?
Any organization using h2o versions prior to 2.3.0 in a multi-backend server deployment is potentially impacted by CVE-2023-41337.
- agent/references
- agent/type
- agent/event
- agent/remedy
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/dena
- canonical/dena h20
- version/dena h20/2.2.6
- version/dena h20/2.3.0-beta1
- version/dena h20/2.3.0-beta2