The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
Patches
Line
Fixed in
Edition
v6.x (Community)
6.50.0.0
Community
v5.x (LTS)
5.42.0.0
Enterprise — contact [email protected] (if Digest auth is present in your v5.x line)
v4.x (LTS)
4.51.0.0
Enterprise — contact [email protected] (if Digest auth is present in your v4.x line)
The fix:
Rejects credentials whose uri parameter does not match the request URL.
Workarounds
For deployments that cannot upgrade immediately:
URI binding gap: place Digest auth behind a reverse proxy that pins requests to a single URL.