CVE-2022-0536: Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
A flaw was found in the follow-redirects package. This flaw allows the exposure of sensitive information to an unauthorized actor due to the usage of insecure HTTP protocol. This issue happens with an Authorization header leak from the same hostname, https-http, and requires a Man-in-the-Middle (MITM) attack.
Other sources
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8 via Authorization Header leak.
References:
https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445
— Red Hat
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by a leakage of the Authorization header from the same hostname during HTTPS to HTTP redirection. By utilize man-in-the-middle attack techniques, an attacker could exploit this vulnerability to obtain Authorization header information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0536?
CVE-2022-0536 is a vulnerability that allows the exposure of sensitive information to an unauthorized actor due to the usage of insecure HTTP protocol.
How does CVE-2022-0536 happen?
CVE-2022-0536 happens when there is an Authorization header leak from the same hostname, https-http, and requires a Man-in-the-Middle attack.
What software is affected by CVE-2022-0536?
The follow-redirects package prior to version 1.14.8 is affected by CVE-2022-0536.
What is the severity of CVE-2022-0536?
The severity of CVE-2022-0536 is medium with a CVSS score of 5.9.
How do I fix CVE-2022-0536?
To fix CVE-2022-0536, upgrade the follow-redirects package to version 1.14.8 or later.