The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count (nc) value it just accepted. When a legitimate client sends non-contiguous nc values (parallel or retried requests, as browsers do), the server's counter lags behind the highest nc seen, and a captured Authorization header can be replayed multiple times.
Impact
A passive observer can turn one captured Digest-authenticated request into several replayed authenticated (state-changing) requests, defeating the core
replay protection Digest provides over Basic.
Preconditions
- Application uses
DigestAuth.
- Attacker can passively observe at least one legitimate digest request.
- Legitimate client emits an
nc more than one greater than the last, for instance from a parallel or retried request.
Workarounds
- Deploy over TLS so requests cannot be captured.
References
rossabaker Analyst
morgen-peschke Remediation reviewer
The
DigestAuthreplay defence storeslastNc + 1rather than the nonce-count (nc) value it just accepted. When a legitimate client sends non-contiguousncvalues (parallel or retried requests, as browsers do), the server's counter lags behind the highestncseen, and a capturedAuthorizationheader can be replayed multiple times.Impact
A passive observer can turn one captured Digest-authenticated request into several replayed authenticated (state-changing) requests, defeating the core
replay protection Digest provides over Basic.
Preconditions
DigestAuth.ncmore than one greater than the last, for instance from a parallel or retried request.Workarounds
References