Robert Elliot created HTTPCLIENT-1256:
-----------------------------------------
Summary: HttpClient permits man in the middle attacks when using
HTTPS
Key: HTTPCLIENT-1256
URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1256
Project: HttpComponents HttpClient
Issue Type: Bug
Components: HttpClient
Affects Versions: 3.1 Final
Reporter: Robert Elliot
Priority: Critical
As documented here:http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf HttpClient
3.1 does not use JSSE correctly - specifically, a request over HTTPS does not
validate that the returned certificate is actually for the domain originally
requested. This means a man in the middle attack via DNS poisoning will work.
I have proven this locally by setting a /etc/hosts entry for www.google.com to
the IP address of github.com. When I then run the following code:
HttpClient client = new HttpClient();
GetMethod get = new GetMethod("https://www.google.com";);
client.executeMethod(get);
System.out.println(get.getResponseBodyAsString());
I am returned the contents of the github.com page. I should have had an
exception warning me that the certificate was not valid for www.google.com.
Whilst I appreciate that 3.x is not under development, given the large number
of applications and libraries (such as Axis 1 & 2) that depend on version 3 it
would seem responsible to fix this vulnerability.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
