CVE-2022-0536: Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
A flaw was found in the follow-redirects package. This flaw allows the exposure of sensitive information to an unauthorized actor due to the usage of insecure HTTP protocol. This issue happens with an Authorization header leak from the same hostname, https-http, and requires a Man-in-the-Middle (MITM) attack.
Other sources
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8 via Authorization Header leak.
References:
https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445
— Red Hat
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by a leakage of the Authorization header from the same hostname during HTTPS to HTTP redirection. By utilize man-in-the-middle attack techniques, an attacker could exploit this vulnerability to obtain Authorization header information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/follow-redirectsto a version that resolves this vulnerability.Fixed in 1.14.8 - Upgrade
Upgrade
redhat/follow-redirectsto a version that resolves this vulnerability.Fixed in 1.14.8 - Upgrade
Upgrade
follow-redirectsto a version that resolves this vulnerability.Fixed in 1.14.8 - Configuration
Configure application/network behavior so redirects do not downgrade from HTTPS to HTTP for requests that include sensitive Authorization headers, to prevent the Authorization header from being leaked during the HTTPS->HTTP redirection flow.
follow-redirects redirect behavior (HTTPS -> HTTP) = avoid redirecting from HTTPS to HTTP when Authorization headers are present - Compensating control
Mitigate man-in-the-middle risk by preventing interception of HTTPS traffic (e.g., enforce strong network/transport security so clients cannot be positioned to manipulate HTTPS to HTTP redirections).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0536?
CVE-2022-0536 is a vulnerability that allows the exposure of sensitive information to an unauthorized actor due to the usage of insecure HTTP protocol.
How does CVE-2022-0536 happen?
CVE-2022-0536 happens when there is an Authorization header leak from the same hostname, https-http, and requires a Man-in-the-Middle attack.
What software is affected by CVE-2022-0536?
The follow-redirects package prior to version 1.14.8 is affected by CVE-2022-0536.
What is the severity of CVE-2022-0536?
The severity of CVE-2022-0536 is medium with a CVSS score of 5.9.
How do I fix CVE-2022-0536?
To fix CVE-2022-0536, upgrade the follow-redirects package to version 1.14.8 or later.