GHSA-9xx4-xjpj-xqcf: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
Event History
Frequently Asked Questions
Which deployments are exposed to body tampering?
Deployments using affected http4k versions and Digest authentication with auth-int over non-TLS channels are exposed. The attacker must be on the network path between the client and server.
What does an attacker need to exploit this issue?
No authentication credentials or user interaction are required, but the attacker needs on-path network access to intercept and modify an authenticated request. They can rewrite the request body while retaining a valid Authorization header.
What is the practical impact?
An attacker can alter the body of an authenticated request and cause state-changing actions to be performed as the victim. The issue affects integrity of request contents rather than confidentiality or availability.
What can be done if an upgrade is not immediately possible?
Use TLS for channels carrying Digest-authenticated requests so an on-path attacker cannot rewrite request bodies. This specifically mitigates the described non-TLS attack path.