CVE-2023-4639: Undertow: cookie smuggling/spoofing

Q: What must an attacker be able to do to exploit this issue?

An attacker must be able to send crafted incoming requests containing cookies with certain value-delimiting characters. Exploitation does not require authentication or user interaction, but the attack complexity is rated high.

Q: What could exploitation allow?

A crafted cookie value could be used to exfiltrate HttpOnly cookie values or spoof additional arbitrary cookie values. This can result in unauthorized access to or modification of data.

Q: Which deployments are affected?

The affected software identified is the Maven artifact io.undertow:undertow-core. The provided information does not specify affected versions, fixed versions, or configuration-based exclusions.

Published Jan 31, 2023

Updated

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Other sources

Problems with Undertow cookie parsing may lead to smuggling or spoofing of cookies in certain conditions.

— Red Hat

Affected Software

2 affected componentsFixes available

maven/io.undertow:undertow-core<2.2.30.Final

2.2.30.Final

maven/io.undertow:undertow-core>=2.3.0.Alpha1<2.3.11.Final

2.3.11.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/io.undertow:undertow-core to a version that resolves this vulnerability.
Fixed in 2.2.30.Final
Upgrade
Upgrade maven/io.undertow:undertow-core to a version that resolves this vulnerability.
Fixed in 2.3.11.Final

Event History

Jan 31, 2023

Data Sourced

via Red Hat·05:54 PM

DescriptionSeverityAffected Software

Nov 17, 2024

CVE Published

via MITRE·10:21 AM

Data Sourced

via MITRE·10:21 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·12:30 PM

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker must be able to send crafted incoming requests containing cookies with certain value-delimiting characters. Exploitation does not require authentication or user interaction, but the attack complexity is rated high.

What could exploitation allow?

A crafted cookie value could be used to exfiltrate HttpOnly cookie values or spoof additional arbitrary cookie values. This can result in unauthorized access to or modification of data.

Which deployments are affected?

The affected software identified is the Maven artifact io.undertow:undertow-core. The provided information does not specify affected versions, fixed versions, or configuration-based exclusions.

CVE-2023-4639: Undertow: cookie smuggling/spoofing

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What could exploitation allow?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What could exploitation allow?

Which deployments are affected?