Botan: Online OCSP redirects enable blind requests to internal HTTP services
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.13.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Botan, a C++ cryptography library, is affected by this vulnerability in its online OCSP client, which can be redirected to send a single blind request to internal HTTP services that are otherwise unreachable. This could allow an attacker to trigger unintended actions on internal services (such as non-idempotent GET handlers) and to infer information about them from response timing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- randombit botan
fixed in 3.13.0