| Package | Affected versions | Patched versions |
|---|---|---|
| org.http4s:http4s-client_2.12 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
| org.http4s:http4s-client_2.13 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
| org.http4s:http4s-client_3 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
| org.http4s:http4s-server_2.10 | ≤ 0.21.28 | |
| org.http4s:http4s-server_2.11 | ≤ 0.21.28 | |
| org.http4s:http4s-server_2.12 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields:
Header.nameåHeader.value)Status.reason)Uri.Path)URI.RegName) (through 0.21)The following backends render invalid carriage return, newline, or null characters in an unsafe fashion.
| blaze-server | ember-server | blaze-client | ember-client | jetty-client | |
|---|---|---|---|---|---|
| header names | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ |
| header values | ⚠ | ⚠ | ⚠ | ⚠ | |
| status reasons | ⚠ | ⚠ | |||
| URI paths | ⚠ | ⚠ | |||
| URI regnames | ⚠ < 0.22 | ⚠ < 0.22 |
For example, given the following service:
import cats.effect._
import org.http4s._
import org.http4s.dsl.io._
import org.http4s.server.blaze.BlazeServerBuilder
import scala.concurrent.ExecutionContext.global
object ResponseSplit extends IOApp {
override def run(args: List[String]): IO[ExitCode] =
BlazeServerBuilder[IO](global)
.bindHttp(8080)
.withHttpApp(httpApp)
.resource
.use(_ => IO.never)
val httpApp: HttpApp[IO] =
HttpApp[IO] { req =>
req.params.get("author") match {
case Some(author) =>
Ok("The real content")
.map(_.putHeaders(Header("Set-Cookie", s"author=${author}")))
case None =>
BadRequest("No author parameter")
}
}
}
A clean author parameter returns a clean response:
curl -i 'http://localhost:8080/?author=Ross'
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free| org.http4s:http4s-server_2.13 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
| org.http4s:http4s-server_2.13.0-M5 | ≤ 0.21.28 |
| org.http4s:http4s-server_3 | ≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4 | 0.22.50.23.4 |
| http4s | = 1.0.0≥ 0.22.0, < 0.22.5≥ 0.23.0, < 0.23.4< 0.21.29 | 0.22.50.23.40.21.29 |
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Set-Cookie: author=Ross
Date: Mon, 20 Sep 2021 04:12:10 GMT
Content-Length: 16
The real content
A malicious author parameter allows a user-agent to hijack the response from our server and return different content:
curl -i 'http://localhost:8080/?author=hax0r%0d%0aContent-Length:+13%0d%0a%0aI+hacked+you'
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Set-Cookie: author=hax0r
Content-Length: 13
I hacked you
Versions 0.21.29, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following:
\u0000), carriage return (\r), and newline (\n) with space ( ) characters per spec.IllegalArgumentException.IllegalArgumentException.http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
Not all backends were affected: jetty-server, tomcat-server, armeria, and netty on the server; async-http-client, okhttp-client, armeria, and netty as clients.
If you have any questions or comments about this advisory: