Executive brief
The eventsource library, used for handling server-sent events in Node.js applications, fails to strip sensitive HTTP headers (Cookies and Authorization) when following redirects to external domains. This violates the same-origin policy and allows third-party sites to receive authentication credentials intended only for the original server, enabling account takeover or impersonation attacks.
Technical details
The vulnerability is an information disclosure flaw (CWE-200, CWE-212) in the eventsource library's redirect handling. When a server-sent event fetch operation is redirected to a URL on a different origin, the library incorrectly preserves the Cookie and Authorization headers instead of sanitizing them per same-origin policy. An attacker controlling a server that the victim's application follows a redirect to can capture these sensitive headers. The attack requires user interaction (the application must follow the redirect) but no privileges. Patches are available in versions 1.1.1 and 2.0.2 and later.
Affected products
- EventSource eventsource before 1.1.1 and 2.0.0 before 2.0.2
Timeline
- 2022-05-12: disclosed: NVD published
- 2022-05-13: advisory: GitHub advisory published
- 2022-05-12: patched: Fix merged in PR #273