Executive brief
follow-redirects is a Node.js library that automatically handles HTTP redirects for applications. The library was disclosing sensitive information (such as authentication cookies) when redirecting users across different domains, potentially exposing session data to unintended recipients. This could allow attackers to intercept sensitive credentials if an application redirects to a malicious third-party domain.
Technical details
follow-redirects is vulnerable to information disclosure (CWE-359) where sensitive HTTP headers, particularly authentication cookies, are transmitted across domain boundaries during redirect chains. The vulnerability occurs when the library automatically follows HTTP redirects without filtering security-sensitive headers before sending requests to different domains. An attacker can exploit this by crafting a redirect chain that originates from a legitimate domain and redirects to an attacker-controlled domain, causing the victim application to leak cookies and credentials. The fix, implemented in version 1.14.7, drops the Cookie header when following redirects across domain boundaries.
Affected products
- follow-redirects follow-redirects before 1.14.7
Timeline
- 2022-01-12: disclosed: Advisory published
- 2022-01-11: patched: Fix released in version 1.14.7