hc-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Robert Elliot (JIRA)" <j...@apache.org>
Subject [jira] [Created] (HTTPCLIENT-1256) HttpClient permits man in the middle attacks when using HTTPS
Date Sat, 27 Oct 2012 20:29:11 GMT
Robert Elliot created HTTPCLIENT-1256:
-----------------------------------------

             Summary: HttpClient permits man in the middle attacks when using HTTPS
                 Key: HTTPCLIENT-1256
                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1256
             Project: HttpComponents HttpClient
          Issue Type: Bug
          Components: HttpClient
    Affects Versions: 3.1 Final
            Reporter: Robert Elliot
            Priority: Critical


As documented here:http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf HttpClient 3.1 does not
use JSSE correctly - specifically, a request over HTTPS does not validate that the returned
certificate is actually for the domain originally requested. This means a man in the middle
attack via DNS poisoning will work.

I have proven this locally by setting a /etc/hosts entry for www.google.com to the IP address
of github.com. When I then run the following code:

HttpClient client = new HttpClient();
GetMethod get = new GetMethod("https://www.google.com");
client.executeMethod(get);
System.out.println(get.getResponseBodyAsString());

I am returned the contents of the github.com page. I should have had an exception warning
me that the certificate was not valid for www.google.com.

Whilst I appreciate that 3.x is not under development, given the large number of applications
and libraries (such as Axis 1 & 2) that depend on version 3 it would seem responsible
to fix this vulnerability.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org


Mime
View raw message