Update dependency follow-redirects to v1.15.6 [SECURITY] #81

renovate · 2024-01-09T02:34:31Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
follow-redirects	`1.11.0` -> `1.15.6`

GitHub Vulnerability Alerts

CVE-2022-0155

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVE-2022-0536

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

CVE-2023-26159

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

CVE-2024-28849

When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.

Steps To Reproduce & PoC

Test code:

const axios = require('axios');

axios.get('http://127.0.0.1:10081/', {
 headers: {
 'AuThorization': 'Rear Test',
 'ProXy-AuthoriZation': 'Rear Test',
 'coOkie': 't=1'
 }
})
 .then((response) => {
 console.log(response);
 })

When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.

Impact

This vulnerability may lead to credentials leak.

Recommendations

Remove proxy-authentication header during cross-domain redirect

Recommended Patch

follow-redirects/index.js:464

- removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
+ removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers);

Release Notes

follow-redirects/follow-redirects (follow-redirects)

Update dependency follow-redirects to v1.15.6 [SECURITY] #81

Are you sure you want to change the base?

Update dependency follow-redirects to v1.15.6 [SECURITY] #81

Conversation

renovate bot commented Jan 9, 2024 • edited Loading

GitHub Vulnerability Alerts

Steps To Reproduce & PoC

Impact

Recommendations

Recommended Patch

Release Notes

Configuration

renovate bot commented Jan 9, 2024 •

edited

Loading