CyberRota Analysis
AI-GeneratedThe http4k toolkit for Kotlin HTTP applications is vulnerable in versions prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, where the DigestAuthProvider.verify method fails to validate the URI in Digest authentication responses. This flaw allows attackers to replay captured authentication responses against different URLs within the same realm, potentially leading to unauthorized access to sensitive data. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of credential replay attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest authentication response can replay it against another URL served by the same realm, bypassing the per-request-URI binding and potentially gaining unauthorized read or write access. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.50.0.0.