CVE-2024-28849: Proxy-Authorization header kept across hosts in follow-redirects

Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by the leakage of credentials when clearing authorization header during cross-domain redirect, but keeping the proxy-authentication header. An attacker could exploit this vulnerability to obtain credentials and other sensitive information.

— IBM

Proxy-Authorization header kept across hosts in follow-redirects

— Microsoft

When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.

Steps To Reproduce & PoC

Test code:

js const axios = require('axios');

axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' } }) .then((response) => { console.log(response); })

When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.

Impact

This vulnerability may lead to credentials leak.

Recommendations

Remove proxy-authentication header during cross-domain redirect

Recommended Patch

follow-redirects/index.js:464

diff - removeMatchingHeaders(/^(?:authorization|cookie)$/i, this.options.headers); + removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this.options.headers);

— GitHub