Libsoup Digest Authentication Replay Vulnerability Allowing Bypass of Authentication

A vulnerability exists in Libsoup's server-side digest authentication within the SoupAuthDomainDigest class. The issue arises because the implementation fails to properly manage nonces and does not enforce the required incrementing nonce-count (nc) attribute. This flaw enables remote attackers to capture a valid authentication header and replay it multiple times, effectively bypassing authentication and gaining unauthorized access to protected resources while impersonating the legitimate user.

Impact

Exploiting this vulnerability allows for authentication bypass, enabling unauthorized access to protected resources.

Reproduction

The vulnerability can be reproduced by capturing a valid Authorization header from a user. This header can then be replayed multiple times to bypass authentication and access protected resources as the user.