CyberRota Analysis
AI-GeneratedHttp4s versions prior to 0.23.35 and 1.0.0-M47 are vulnerable due to improper handling of nonce-count values in Digest Authentication, allowing attackers to replay captured Authorization headers and execute authenticated requests. This vulnerability can lead to unauthorized state-changing operations, posing a risk to applications relying on Http4s for HTTP services. Developers and security teams using affected versions should prioritize updating to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.