HttpClient proxyClient is not thread safe.

I wanted to note here that I had a huge security issue occurring in my environment.
After tons and tons of investigation I have nailed it down to the ProxyServlet class under org.mitre.dsmiley.httpproxy.

A servlet instance is created only once when the server starts and it is used by all users.

Amazing explanation under BalusC's comment here http://stackoverflow.com/questions/3106452/how-do-servlets-work-instantiation-shared-variables-and-multithreading

In your ProxyServlet you have the HttpClient proxyClient created only once in the init() of the servlet.
This proxyClient instance is getting used by all users and it looks like it holds some variables from the one user when moving to the next one. I am using this proxy servlet to establish and grab login information from another web application that does NTLM authentication.

A quick fix is that you generate a proxyClient instance for each user and each session...

So under ProxyServlet class within protected void service

add these lines of code :

        HttpClient theadSafeProxyClient = null;
        HttpSession session = servletRequest.getSession();

        if(session.getAttribute("proxyClient")!=null)
            theadSafeProxyClient = (HttpClient)session.getAttribute("proxyClient");
        else {
            BasicHttpParams hcParams = new BasicHttpParams();
            hcParams.setParameter("http.protocol.cookie-policy", "ignoreCookies");
            this.readConfigParam(hcParams, "http.protocol.handle-redirects", Boolean.class);
            theadSafeProxyClient = this.createHttpClient(hcParams);
            session.setAttribute("proxyClient", theadSafeProxyClient );
        }

before :

proxyResponse1 = theadSafeproxyClient.execute(this.getTargetHost(servletRequest), (HttpRequest)proxyRequest);

Start in ProxyServlet under org.mitre.dsmiley.httpproxy, comparing the HttpClient created in init() with its use from service(). Review the servlet lifecycle and the reported NTLM authentication behavior, then check existing tests or add a focused reproduction for requests from different users. Done means client state is not incorrectly shared between users and the relevant authentication behavior is covered.