http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/http4k/http4k/commit/4f904b4692
disclosure@vulncheck.com
https://github.com/http4k/http4k/commit/8a52b615b1
disclosure@vulncheck.com
https://github.com/http4k/http4k/security/advisories/GHSA-c7jm-38gq-h67h
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-digest-authenticati…
disclosure@vulncheck.com