Description
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
http4k http4k
Default version status: unaffected
6.0.0.0 to < 6.48.0.0affected6.48.0.0unaffected
pkg:maven/org.http4k/http4k-security-digesthttp4k http4k
Default version status: unaffected
5.0.0.0 to < 5.42.0.0affected5.42.0.0unaffected
pkg:maven/org.http4k/http4k-security-digesthttp4k http4k
Default version status: unaffected
0 to < 4.51.0.0affected4.51.0.0unaffected
pkg:maven/org.http4k/http4k-security-digest