Executive brief
phin is a lightweight HTTP client library for Node.js. When following HTTP redirects with the followRedirects option enabled, the library may leak sensitive headers (such as authentication tokens) to redirect destination servers, potentially exposing credentials to untrusted hosts.
Technical details
The vulnerability is an information disclosure issue (CWE-200) in phin's redirect handling. When a request with sensitive headers (e.g., Authorization, Cookie) encounters an HTTP redirect, those headers are not properly filtered before being included in the subsequent request to the redirect destination. This occurs when the followRedirects option is enabled. An attacker controlling a redirect target could capture sensitive authentication headers. The issue was fixed in version 3.7.1 by adopting the follow-redirects library, which implements proper header sanitization across cross-origin redirects.
Affected products
- phin phin < 3.7.1
Timeline
- 2024-04-11: disclosed
- 2024-04-11: patched: Fixed in version 3.7.1