CVE-2022-1650: Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource
A flaw was found in the EventSource NPM Package. The description from the source states the following message: "Exposure of Sensitive Information to an Unauthorized Actor." This flaw allows an attacker to steal the user's credentials and then use the credentials to access the legitimate website.
Other sources
EventSource could allow a remote attacker to obtain sensitive information, caused by the exposure of resources to the wrong sphere. By redirecting the victim to a malicious site, an attacker could exploit this vulnerability to obtain Cookies and Authorisation headers, and use this information to launch further attacks against the affected system.
— IBM
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.
https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4
— Red Hat
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1650?
CVE-2022-1650 is categorized as a high severity vulnerability due to the risk of credential theft.
How do I fix CVE-2022-1650?
To remediate CVE-2022-1650, upgrade to the patched versions of the affected packages, specifically eventsource version 2.0.2 or later.
Which software is affected by CVE-2022-1650?
CVE-2022-1650 affects the eventsource NPM package and various Red Hat Dotnet packages including rh-dotnet31-dotnet and rh-dotnet60-dotnet.
What kind of attack does CVE-2022-1650 facilitate?
CVE-2022-1650 allows attackers to expose sensitive information, leading to potential credential theft for unauthorized access.
Is there a known exploitation method for CVE-2022-1650?
Yes, exploitation of CVE-2022-1650 can occur through weaknesses in the eventsource NPM package that allow attackers to steal user credentials.