CVE-2024-28849: follow-redirects Proxy-Authorization header disclosure in cross-domain redirects

CVE-2024-28849 · Severity: low · CVSS 3.1 · Published 2024-03-14

follow-redirects is a popular Node.js library used by axios and other HTTP clients to transparently handle HTTP redirects. The library fails to remove the Proxy-Authorization header (which contains credentials for authenticating to proxy servers) when requests are redirected across different domains, unlike how it properly clears regular Authorization and Cookie headers. An attacker controlling a target domain could receive proxy credentials intended for a different host, potentially compromising proxy infrastructure security.

Technologies: follow-redirects (npm). Vendors: npm.

Quick answers

Is CVE-2024-28849 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-28849 being exploited in the wild.
How severe is CVE-2024-28849?
Low severity, with a CVSS score of 3.1, published 14 March 2024.
Which products and versions are affected?
follow-redirects (npm) SEMVER:introduced=0,fixed=1.15.6.
Is there a fix for CVE-2024-28849?
Yes. follow-redirects (npm): upgrade to 1.15.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-28849 attacked?
It is attacked over the network.
Am I affected by CVE-2024-28849?
Check whether you run follow-redirects (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • follow-redirects (npm): upgrade to 1.15.6 or later
    npm install follow-redirects@1.15.6

Technical details

The vulnerability is an information disclosure flaw in follow-redirects' cross-domain redirect handling. The library's removeMatchingHeaders() function removes Authorization and Cookie headers during cross-domain redirects (per RFC 7231 and Fetch spec), but does not include Proxy-Authorization in the clearance regex. This allows proxy credentials to leak to destination hosts during redirects. The attack requires a cross-domain redirect to occur (which can be triggered by a legitimate HTTP 3xx response from the initial server), and the attacker must control the redirect target host. The fix adds "proxy-authorization" to the headers cleared during cross-domain redirects and was released in version 1.15.6.

Affected products

  • follow-redirects follow-redirects < 1.15.6

Identifiers

  • CVE-2024-28849
  • GHSA-cxjh-pqwp-8mfp

Timeline

  • 2024-03-14: disclosed
  • 2024-03-14: patched: Fixed in version 1.15.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.