Summary
AsyncHttpClient can reuse a connection authenticated for one identity when processing a request from another identity because connection-pool partitioning omits authentication-defining fields. Under affected Kerberos, SPNEGO, NTLM, SOCKS, or proxy configurations, this may expose the first identity's data or authority to a different caller.
AsyncHttpClient can reuse a connection authenticated for one identity when processing a request from another identity because connection-pool partitioning omits authentication-defining fields. Under affected Kerberos, SPNEGO, NTLM, SOCKS, or proxy configurations, this may expose the first identity's data or authority to a different caller.
Affected context
The vulnerability occurs in AsyncHttpClient deployments that use connection pooling together with authentication mechanisms or proxy paths whose identity-defining attributes are not fully represented in pool partitioning. Risk is higher when multiple callers, users, principals, proxy realms, or authentication contexts share a client or connection pool.
The vulnerability occurs in AsyncHttpClient deployments that use connection pooling together with authentication mechanisms or proxy paths whose identity-defining attributes are not fully represented in pool partitioning. Risk is higher when multiple callers, users, principals, proxy realms, or authentication contexts share a client or connection pool.
Exploit preconditions
- Attack surface: Applications making authenticated HTTP requests through AsyncHttpClient
- Required access: The ability to submit or trigger requests through a shared client, service, or connection pool
- Trigger point: Allocation or reuse of an existing authenticated socket for a later request
- Why exploitation is possible: Pooling may treat requests with distinct authentication identities as equivalent, allowing a connection authenticated under one identity to serve another caller
- Relevant paths: Kerberos, SPNEGO, NTLM, authenticated proxies, SOCKS proxies, and CONNECT proxy connections
- Attack surface: Applications making authenticated HTTP requests through AsyncHttpClient
- Required access: The ability to submit or trigger requests through a shared client, service, or connection pool
- Trigger point: Allocation or reuse of an existing authenticated socket for a later request
- Why exploitation is possible: Pooling may treat requests with distinct authentication identities as equivalent, allowing a connection authenticated under one identity to serve another caller
- Relevant paths: Kerberos, SPNEGO, NTLM, authenticated proxies, SOCKS proxies, and CONNECT proxy connections
Why this happens
The underlying bug is incomplete identity separation in connection-pool partitioning. Authentication attributes that determine which principal, user, proxy realm, or authority a socket represents are not consistently included when deciding whether a connection can be reused.
This behavior maps primarily to CWE-863: Incorrect Authorization, because a request may execute using authorization established for a different identity. It is also related to CWE-346: Origin Validation Error, since the connection's authenticated origin or security context is not reliably validated before reuse.
The underlying bug is incomplete identity separation in connection-pool partitioning. Authentication attributes that determine which principal, user, proxy realm, or authority a socket represents are not consistently included when deciding whether a connection can be reused.
This behavior maps primarily to CWE-863: Incorrect Authorization, because a request may execute using authorization established for a different identity. It is also related to CWE-346: Origin Validation Error, since the connection's authenticated origin or security context is not reliably validated before reuse.
Potential impact
- A request may execute with another identity's authenticated authority
- Sensitive response data may be disclosed across callers or tenants
- Actions may be attributed to the wrong user or principal
- An attacker could cause unauthorized access to protected services
- Proxy or upstream service permissions may be misapplied
- A request may execute with another identity's authenticated authority
- Sensitive response data may be disclosed across callers or tenants
- Actions may be attributed to the wrong user or principal
- An attacker could cause unauthorized access to protected services
- Proxy or upstream service permissions may be misapplied
General mitigation guidance
Mitigation generally focuses on preserving strict separation between authenticated connection contexts.
Common defensive patterns include:
- Ensuring connection-pool keys include every identity-defining authentication and proxy attribute
- Using separate clients or pools for distinct principals, tenants, proxy realms, or trust contexts
- Disabling connection reuse where identity isolation cannot be established reliably
- Avoiding shared authenticated clients across mutually untrusted callers
- Applying least privilege to service accounts, proxy credentials, and upstream permissions
- Validating that the authenticated connection context matches the requesting identity before reuse
- Limiting credential scope and reducing the amount of sensitive data returned through shared services
Mitigation generally focuses on preserving strict separation between authenticated connection contexts.
Common defensive patterns include:
- Ensuring connection-pool keys include every identity-defining authentication and proxy attribute
- Using separate clients or pools for distinct principals, tenants, proxy realms, or trust contexts
- Disabling connection reuse where identity isolation cannot be established reliably
- Avoiding shared authenticated clients across mutually untrusted callers
- Applying least privilege to service accounts, proxy credentials, and upstream permissions
- Validating that the authenticated connection context matches the requesting identity before reuse
- Limiting credential scope and reducing the amount of sensitive data returned through shared services
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis and dependency review focused on connection-pool partition keys
- Code review checks for shared HTTP clients used across users or tenants
- Tests that issue equivalent requests under distinct Kerberos, SPNEGO, NTLM, proxy, and SOCKS identities
- Runtime logging that correlates request identity, proxy realm, authenticated principal, and connection identifier
- Policy enforcement preventing authenticated connection pools from being shared across trust boundaries
- Automated security review tools that flag connection reuse without explicit authentication-context separation
Organizations can look for this issue through:
- Static analysis and dependency review focused on connection-pool partition keys
- Code review checks for shared HTTP clients used across users or tenants
- Tests that issue equivalent requests under distinct Kerberos, SPNEGO, NTLM, proxy, and SOCKS identities
- Runtime logging that correlates request identity, proxy realm, authenticated principal, and connection identifier
- Policy enforcement preventing authenticated connection pools from being shared across trust boundaries
- Automated security review tools that flag connection reuse without explicit authentication-context separation
