Executive brief
fluture-node is a utility library used for handling web requests in Node.js applications. A security flaw in versions 4.0.0 and 4.0.1 fails to remove sensitive login information, such as passwords or session cookies, when a website redirects a user to a different, potentially malicious domain. This could allow an attacker to steal user credentials or session data if they control the destination of a redirect.
Technical details
The vulnerability is a sensitive information leak (CWE-212/CWE-200) within the redirection logic of fluture-node. When using the `followRedirects` or `followRedirectsWith` functions, the library fails to strip confidential headers (e.g., Authorization, Cookie) if the request is redirected to a third-party domain or from HTTPS to an unencrypted HTTP connection. An attacker who can trigger or control a redirect from a trusted server to an attacker-controlled origin can capture these sensitive headers. The issue is fixed in version 4.0.2, which introduces automatic header redaction across different origins.
Affected products
- fluture-js fluture-node >= 4.0.0, < 4.0.2
Timeline
- 2022-03-01: disclosed
- 2022-03-01: patched
- 2022-03-01: advisory
References
- https://github.com/fluture-js/fluture-node/security/advisories/GHSA-32x6-qvw6-mxj4
- https://github.com/psf/requests/pull/4718
- https://github.com/fluture-js/fluture-node/commit/0c99bc511533d48be17dc6bfe641f7d0aeb34d77
- https://github.com/fluture-js/fluture-node/commit/125e4474f910c1507f8ec3232848626fbc0f55c4
- https://github.com/pypa/advisory-database/tree/main/vulns/request-util/PYSEC-2022-43052.yaml