Log in Start free

Vulnerability · Published Mar 14, 2024 · Assigned by GitHub_M

CVE-2024-28849Proxy-Authorization header kept across hosts in follow-redirects

Medium 6.5

In plain English

A medium-severity information exposure in follow-redirects from follow-redirects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 35.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-follow-redirectsno fix listedDEBIAN-CVE-2024-28849
Debian:13node-follow-redirects1.15.6+~1.14.4-1DEBIAN-CVE-2024-28849
Debian:14node-follow-redirects1.15.6+~1.14.4-1DEBIAN-CVE-2024-28849
npmfollow-redirects1.15.6GHSA-cxjh-pqwp-8mfp

Affected products (as reported)

VendorProductVersions
follow-redirects follow-redirects < 1.15.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References