HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Date: 2026-03
Affected: maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities, maven/ca.uhn.hapi.fhir:org.hl7.fhir.core
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-34359
CWE: CWE-346
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

## Summary `ManagedWebAccessUtils.getServer()` uses `String.startsWith()` to match request URLs against configured server URLs for authentication credential dispatch. Because configured server URLs (e.g., `http://tx.fhir.org`) lack a trailing slash or host boundary check, an attacker-controlled domain like `http://tx.fhir.org.attacker.com` matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect to that domain. ## Details The root cause is in `ManagedWebAccessUtils.getServer()` at `org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/ManagedWebAccessUtils.java:26`: ```java public static ServerDetailsPOJO getServer(String url, Iterable<ServerDetailsPOJO> serverAuthDetails) { if (serverAuthDetails != null) { for (ServerDetailsPOJO serverDetails : serverAuthDetails) { if (url.startsWith(serverDetails.getUrl())) { // <-- no host boundary check return serverDetails; } } } return null; } ``` The configured production terminology server URL is defined without a trailing slash in `FhirSettingsPOJO.java:19`: ```java protected static final String TX_SERVER_PROD = "http://tx.fhir.org"; ``` This means: - `"http://tx.fhir.org.attacker.com/capture".startsWith("http://tx.fhir.org")` → **true** - `"http://tx.fhir.org:8080/evil".startsWith("http://tx.fhir.org")` → **true** **Exploit chain via SimpleHTTPClient (redirect path):** 1. `SimpleHTTPClient.ge


Mitigations:

Architectural layers (MAESTRO):