Executive brief
Got is a popular HTTP client library for Node.js used by developers to make web requests. A vulnerability in versions before 11.8.5 and 12.x before 12.1.0 allows attackers to redirect HTTP requests to UNIX sockets, potentially enabling unauthorized access to local services or files on a compromised system. This could bypass network security boundaries and expose sensitive local resources.
Technical details
The vulnerability is a redirect validation bypass in the Got HTTP client library. The flaw allows an attacker controlling an HTTP server to issue a redirect response (e.g., 301/302) pointing to a UNIX socket path (e.g., file:///var/run/socket), which the Got client will follow without proper validation. An attacker would need to trick an application using Got into making a request to a malicious server they control. If successful, the redirect could connect to local UNIX sockets, potentially exposing privileged services or data. The issue was patched in versions 11.8.5 and 12.1.0 by implementing validation to block redirects to UNIX socket destinations.
Affected products
- Sindre Sorhus Got before 11.8.5, and 12.0.0 through 12.0.x before 12.1.0
Timeline
- 2022-06-19: disclosed
- 2022-05-25: patched: Fix merged in PR #2047