CVE-2023-4639
Published: 17 November 2024
Summary
CVE-2023-4639 is a high-severity HTTP Request/Response Smuggling (CWE-444) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A flaw was found in Undertow that causes incorrect parsing of cookies containing certain value-delimiting characters in incoming HTTP requests. The affected component is the Undertow web server used in Red Hat middleware products. The vulnerability, tracked as CVE-2023-4639 and assigned CWE-444, permits construction of malicious cookie values that can exfiltrate HttpOnly cookies or inject arbitrary additional cookies, resulting in impacts to data confidentiality and integrity. It carries a CVSS 3.1 base score of 7.4.
An unauthenticated remote attacker can exploit the issue over the network by sending crafted requests containing specially formatted cookies. Successful exploitation allows the attacker to read or overwrite sensitive session or authentication cookies without requiring user interaction, potentially leading to unauthorized access or modification of application data.
Red Hat has published multiple advisories (RHSA-2024:1674, RHSA-2024:1675, RHSA-2024:1676, RHSA-2024:1677, and RHSA-2024:2763) that address the flaw through updated Undertow packages. The EPSS score has remained flat at 0.0736 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3185
Vulnerability details
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading…
more
to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.