Junglewise Threat Intelligence

CVE-2023-30846: Microsoft typed-rest-client credential leakage on HTTP redirects

CVE-2023-30846 · Severity: low · CVSS 3.1 · Published 2023-04-27

Vendors: npm, Microsoft.

Executive brief

The typed-rest-client library, used by developers to make authenticated HTTP requests from Node.js applications, has a critical flaw where it leaks authentication credentials to unrelated third-party servers during HTTP redirects. When a legitimate server redirects a request to another domain, the library automatically forwards authentication tokens to the redirected destination—a behavior that violates HTTP standards. An attacker controlling a malicious server or able to perform DNS/network manipulation could intercept these credentials and gain unauthorized access to protected resources.

Technical details

The vulnerability is an improper credential handling issue (CWE-522) in HTTP redirect handling. When a request containing BasicCredentialHandler, BearerCredentialHandler, or PersonalAccessTokenCredentialHandler receives a 3xx redirect response, the library forwards the Authorization header to the new location without verifying it is the same origin. The attack requires no authentication or special preconditions; any application using the vulnerable library to make authenticated requests that encounter a cross-origin redirect will leak credentials. An attacker can exploit this through DNS poisoning, BGP hijacking, or by controlling an intermediate server. The fix, applied in version 1.8.0 (committed April 1, 2020), disables authentication headers on redirects across different origins unless explicitly enabled via an allowCrossOriginAuthentication flag. This approach mirrors the solution adopted by curl (CVE-2018-1000007).

Affected products

  • Microsoft typed-rest-client < 1.8.0

Timeline

  • 2023-04-27: disclosed: GHSA-558p-m34m-vpmq published
  • 2020-04-01: patched: Fix merged in PR #207 and committed

References