CVE-2023-41337

Summary

CVE-2023-41337 is a vulnerability affecting the h2o HTTP server in versions 2.3.0-beta2 and prior. When h2o is configured to listen to multiple addresses or ports with different backend servers managed by multiple entities, a malicious backend entity can manipulate HTTPS requests by misdirecting them to a different address or port. The attacker must already be authorized as a backend server and can potentially observe or inject packets between the client and h2o. Once a TLS session is misdirected, HTTPS requests from the victim client may be forwarded to the attacker's server. The vulnerability only exists if h2o is configured to listen to various addresses or ports and connect to backend servers managed by different entities. A patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab, and using global-level listen directives instead of host-level ones is suggested as a workaround.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.