Summary
AsyncHttpClient can treat a proxy tunnel as established based on the previous request method instead of verifying the proxy's CONNECT response. If a proxy rejects CONNECT, redirect or authentication handling may send an origin request and its Authorization credentials over the still-plaintext proxy connection.
An attacker able to observe that connection could recover Basic credentials directly, or potentially crack or relay NTLM authentication responses.
AsyncHttpClient can treat a proxy tunnel as established based on the previous request method instead of verifying the proxy's CONNECT response. If a proxy rejects CONNECT, redirect or authentication handling may send an origin request and its Authorization credentials over the still-plaintext proxy connection.
An attacker able to observe that connection could recover Basic credentials directly, or potentially crack or relay NTLM authentication responses.
Affected context
The issue occurs in AsyncHttpClient deployments that use HTTP proxy tunneling together with redirect or authentication handlers. Risk increases when the configured proxy rejects a CONNECT request but the client continues processing the connection as though a secure tunnel had been created, allowing subsequent origin traffic and authentication material to traverse the proxy connection without the expected protection.
The issue occurs in AsyncHttpClient deployments that use HTTP proxy tunneling together with redirect or authentication handlers. Risk increases when the configured proxy rejects a CONNECT request but the client continues processing the connection as though a secure tunnel had been created, allowing subsequent origin traffic and authentication material to traverse the proxy connection without the expected protection.
Exploit preconditions
- Attack surface: HTTP proxy-mediated outbound requests from an AsyncHttpClient application
- Required access: Ability to observe, control, or operate the relevant proxy connection or network path
- Trigger point: A proxy rejects CONNECT and a redirect or authentication handler subsequently writes an origin request
- Why exploitation is possible: The client infers tunnel state from the prior request method rather than validating the CONNECT response, so credentials may be transmitted over a plaintext proxy connection
- Attack surface: HTTP proxy-mediated outbound requests from an AsyncHttpClient application
- Required access: Ability to observe, control, or operate the relevant proxy connection or network path
- Trigger point: A proxy rejects CONNECT and a redirect or authentication handler subsequently writes an origin request
- Why exploitation is possible: The client infers tunnel state from the prior request method rather than validating the CONNECT response, so credentials may be transmitted over a plaintext proxy connection
Why this happens
The underlying bug is incorrect state tracking for HTTP proxy tunneling. AsyncHttpClient can rely on the last request method as an indication that a tunnel exists instead of treating successful CONNECT completion as the authoritative condition.
When CONNECT fails, later request or authentication handling may still write origin data and Authorization headers to the proxy connection. This behavior maps primarily to CWE-319: Cleartext Transmission of Sensitive Information, with related aspects of CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') and CWE-522: Insufficiently Protected Credentials.
The underlying bug is incorrect state tracking for HTTP proxy tunneling. AsyncHttpClient can rely on the last request method as an indication that a tunnel exists instead of treating successful CONNECT completion as the authoritative condition.
When CONNECT fails, later request or authentication handling may still write origin data and Authorization headers to the proxy connection. This behavior maps primarily to CWE-319: Cleartext Transmission of Sensitive Information, with related aspects of CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') and CWE-522: Insufficiently Protected Credentials.
Potential impact
- An attacker may recover Basic authentication credentials in readable form.
- NTLM authentication responses could be cracked or relayed.
- Unauthorized users may gain access to protected services.
- Sensitive origin request data may be disclosed to a proxy or network observer.
- Compromised credentials could enable lateral movement or account impersonation.
- An attacker may recover Basic authentication credentials in readable form.
- NTLM authentication responses could be cracked or relayed.
- Unauthorized users may gain access to protected services.
- Sensitive origin request data may be disclosed to a proxy or network observer.
- Compromised credentials could enable lateral movement or account impersonation.
General mitigation guidance
Mitigation generally focuses on making proxy tunnel state dependent on verified protocol responses and preventing authentication data from being sent unless the intended protected channel is established.
Common defensive patterns include:
- Treating only a successful CONNECT response as evidence that a tunnel exists.
- Failing closed when proxy negotiation is rejected or produces an unexpected response.
- Avoiding automatic credential forwarding across redirects or untrusted proxy boundaries.
- Restricting authentication schemes and preferring mechanisms that provide channel binding or stronger protection where supported.
- Minimizing credential privileges and scope so exposed credentials have limited value.
- Enforcing trusted proxy configuration and protected transport for outbound requests.
Mitigation generally focuses on making proxy tunnel state dependent on verified protocol responses and preventing authentication data from being sent unless the intended protected channel is established.
Common defensive patterns include:
- Treating only a successful CONNECT response as evidence that a tunnel exists.
- Failing closed when proxy negotiation is rejected or produces an unexpected response.
- Avoiding automatic credential forwarding across redirects or untrusted proxy boundaries.
- Restricting authentication schemes and preferring mechanisms that provide channel binding or stronger protection where supported.
- Minimizing credential privileges and scope so exposed credentials have limited value.
- Enforcing trusted proxy configuration and protected transport for outbound requests.
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis and code review of proxy state machines, especially logic that derives tunnel state from request methods.
- Tests covering rejected CONNECT responses followed by redirects, retries, or authentication challenges.
- Review signals showing Authorization headers copied into requests after proxy negotiation failures.
- Integration tests that inspect whether credentials are written to a proxy connection before tunnel establishment.
- Network monitoring for authentication headers or NTLM exchanges appearing on unexpected plaintext proxy paths.
- Policy enforcement that restricts outbound proxy use and blocks credential forwarding to untrusted intermediaries.
Automated security review tools may help identify insecure credential propagation and unchecked proxy negotiation states.
Organizations can look for this issue through:
- Static analysis and code review of proxy state machines, especially logic that derives tunnel state from request methods.
- Tests covering rejected CONNECT responses followed by redirects, retries, or authentication challenges.
- Review signals showing Authorization headers copied into requests after proxy negotiation failures.
- Integration tests that inspect whether credentials are written to a proxy connection before tunnel establishment.
- Network monitoring for authentication headers or NTLM exchanges appearing on unexpected plaintext proxy paths.
- Policy enforcement that restricts outbound proxy use and blocks credential forwarding to untrusted intermediaries.
Automated security review tools may help identify insecure credential propagation and unchecked proxy negotiation states.
