Description
When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
Recommendation
Update the follow-redirects package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.15.5
- Patched version(s): 1.15.6
References
- GHSA-cxjh-pqwp-8mfp
- fetch.spec.whatwg.org
- hackerone.com
- lists.fedoraproject.org
- CVE-2024-28849
- CWE-200
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline - CVE-2024-30260
- Undici proxy-authorization header not cleared on cross-origin redirect in fetch - CVE-2024-24758
- Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
- Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - CVE-2022-0536
- Tags:
- npm
- follow-redirects
Anything's wrong? Let us know Last updated on April 02, 2024