GHSA-9qgq-q9j4-4f82: Botan: Online OCSP redirects enable blind requests to internal HTTP services
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Botan's online OCSP client before version 3.13.0 are exposed when they send OCSP requests to responder URIs obtained from a certificate's Authority Information Access extension. The affected behavior permits one HTTP redirect during that request.
What must an attacker control or be able to do?
An attacker must be able to act as the OCSP responder named by the certificate or perform an on-path attack on the OCSP request. They can then issue a redirect that causes the client to make one blind HTTP request to an otherwise unreachable internal service.
What can an attacker learn or change through the redirected request?
The impact is blind SSRF: response timing may provide a coarse oracle about internal services, and internal services with non-idempotent GET handlers may be affected. The provided information does not indicate that the attacker can read the redirected service's response.
What is the remediation?
Upgrade Botan to version 3.13.0, which fixes the redirect behavior in the online OCSP client.