CVE-2023-41337
CVSS 3.1 Score 6.7 of 10 (medium)
Details
Summary
CVE-2023-41337 is a vulnerability affecting the h2o HTTP server in versions 2.3.0-beta2 and prior. When h2o is configured to listen to multiple addresses or ports with different backend servers managed by multiple entities, a malicious backend entity can manipulate HTTPS requests by misdirecting them to a different address or port. The attacker must already be authorized as a backend server and can potentially observe or inject packets between the client and h2o. Once a TLS session is misdirected, HTTPS requests from the victim client may be forwarded to the attacker's server. The vulnerability only exists if h2o is configured to listen to various addresses or ports and connect to backend servers managed by different entities. A patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab, and using global-level listen directives instead of host-level ones is suggested as a workaround.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Dena H2o
Affected Vendors
- Dena
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions