CVE-2024-53990: AsyncHttpClient Auth Bypass Vulnerability

CVE-2024-53990 Overview

The AsyncHttpClient (AHC) library, a widely-used Java library for executing asynchronous HTTP requests, contains a critical authentication bypass vulnerability in its cookie handling mechanism. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) silently replaces explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests, leading to authentication bypass and potential unauthorized access to sensitive data.

Critical Impact

Multi-user applications using AsyncHttpClient may inadvertently serve requests with cookies belonging to other users, enabling authentication bypass, session hijacking, and unauthorized data access.

Affected Products

• AsyncHttpClient (AHC) Java library
• Applications using AHC's auto-managed CookieStore feature
• Multi-user services relying on explicit cookie definitions

Discovery Timeline

• 2024-12-02 - CVE CVE-2024-53990 published to NVD
• 2024-12-02 - Last updated in NVD database

Technical Details for CVE-2024-53990

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication). The flaw resides in how the AsyncHttpClient library handles cookie management during HTTP request construction. The CookieStore, which is enabled by default, maintains a persistent collection of cookies across requests. When developers explicitly set cookies on a request—such as session tokens or authentication credentials—the library's addOrReplaceCookie() method unconditionally overwrites these with matching cookies from the internal cookie jar.

In multi-tenant or multi-user environments where a single AHC instance handles requests for different users, this behavior creates a dangerous condition where User A's authentication cookies could be silently substituted with User B's cookies from a previous request. The attack surface is network-accessible, meaning any application exposed over a network that uses the vulnerable cookie handling pattern is potentially affected.

Root Cause

The root cause lies in the DefaultAsyncHttpClient.java implementation, specifically in the request building phase where cookies from the CookieStore are processed. The original implementation used addOrReplaceCookie() which unconditionally replaces cookies by name, regardless of whether the developer had explicitly set that cookie for the current request. This design flaw fails to distinguish between developer-specified cookies that should take precedence and cached cookies from the cookie jar.

Attack Vector

The attack vector is network-based, though exploitation requires specific application conditions. An attacker can exploit this vulnerability in applications where:

1. A shared AsyncHttpClient instance serves multiple users
2. The application explicitly sets user-specific cookies (e.g., session tokens)
3. The CookieStore retains cookies from previous requests

When these conditions are met, a timing-based attack or concurrent request scenario could cause one user's authentication context to be applied to another user's requests.

// Original vulnerable code in DefaultAsyncHttpClient.java
                if (!cookies.isEmpty()) {
                    RequestBuilder requestBuilder = request.toBuilder();
                    for (Cookie cookie : cookies) {
-                        requestBuilder.addOrReplaceCookie(cookie);
+                        requestBuilder.addCookieIfUnset(cookie);
                    }
                    request = requestBuilder.build();
                }

Source: GitHub Commit

Detection Methods for CVE-2024-53990

Indicators of Compromise

• Unexpected authentication events where users gain access to resources they should not have permissions for
• Log entries showing session tokens or authentication cookies being used by multiple distinct user agents or IP addresses
• User reports of viewing or modifying data belonging to other users
• Anomalous request patterns where explicitly set cookies differ from those observed in server-side logs

Detection Strategies

• Implement request/response logging that captures both explicitly set cookies and the final cookies sent in requests to identify discrepancies
• Monitor application logs for session tokens appearing across multiple user contexts within short timeframes
• Deploy runtime application self-protection (RASP) solutions to detect unexpected cookie substitution behavior
• Conduct code audits to identify usage of AsyncHttpClient with shared instances serving multiple users

Monitoring Recommendations

• Enable detailed access logging on backend services to correlate cookie values with user identity
• Implement alerting for authentication anomalies where a single session token is used from multiple source IPs
• Monitor for unusual patterns in concurrent request handling that could indicate cookie cross-contamination
• Review application metrics for unexpected session sharing or authentication state inconsistencies

How to Mitigate CVE-2024-53990

Immediate Actions Required

• Update AsyncHttpClient to the patched version that includes commit d5a83362f7aed81b93ebca559746ac9be0f95425
• Review application architecture to ensure separate AHC instances are used for different user contexts where possible
• Disable the auto-managed CookieStore if explicit cookie management is preferred
• Audit existing deployments for signs of cookie cross-contamination

Patch Information

The fix introduces a new method addCookieIfUnset() in RequestBuilderBase.java that only sets cookies from the CookieStore if they are not already explicitly defined by the developer. This ensures that explicitly set cookies take precedence over cached cookies. The patch is available through the GitHub commit and has been discussed in Pull Request #2033. Additional details are available in the GitHub Security Advisory GHSA-mfj5-cf8g-g2fv.

Workarounds

• Create separate AsyncHttpClient instances for each user context to prevent cookie jar sharing
• Disable the automatic CookieStore by configuring AHC with a no-op or custom CookieStore implementation
• Implement application-level cookie management that bypasses the AHC CookieStore entirely
• Add validation logic to verify cookie ownership before processing responses

# Configuration example for Maven dependency update
# Update your pom.xml to use the patched AsyncHttpClient version
mvn versions:use-latest-releases -Dincludes=org.asynchttpclient:async-http-client
mvn dependency:tree | grep async-http-client