CVE-2020-11021: Authorization Header Stripping Vulnerability in @actions/http-client
Summary
CVE-2020-11021: Impact If consumers of the http-client: 1. Affects @actions/http-client versions < 1.0.8. Fixed in 1.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @actions/http-client package is an npm package used in GitHub Actions workflows to make HTTP requests. It provides a convenient way to send HTTP requests with various options and handles redirects. The package is widely used in GitHub Actions to interact with external APIs and services.
Vulnerability Detail
The vulnerability (CVE-2020-11021) in @actions/http-client allows an attacker to bypass authorization checks when making HTTP requests that result in redirects to a different domain or hostname. If an HTTP request with an authorization header is made and the response leads to a redirect, the authorization header is not stripped before making the redirected request. This means that the authorization header is passed to the other domain, potentially exposing sensitive information. The vulnerability affects versions prior to 1.0.8 of the @actions/http-client package.
How To Fix
Minimum fixed version
1.0.8
This is the first release that contains the fix.
npm install @actions/http-client@1.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to update the @actions/http-client package to the fixed version.
Conclusion
The @actions/http-client package prior to version 1.0.8 is vulnerable to an authorization header stripping issue. This vulnerability can potentially lead to unauthorized access or exposure of sensitive information. It is recommended to update the package to version 1.0.8 or later to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @actions/http-client →
FAQ
The impact of this vulnerability is that the authorization header, which may contain sensitive information, can be passed to a different domain or hostname. This can potentially lead to unauthorized access or exposure of sensitive data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
There are no known exploits for this vulnerability at the moment. However, it is important to update the @actions/http-client package to the fixed version to prevent any potential exploitation.
To check if any other package in your application depends on @actions/http-client, you can use the Vulert Playground (https://vulert.com/scanner) and upload your package-lock.json file. Vulert will provide a comprehensive report of all dependencies and their vulnerabilities.
To update the @actions/http-client package, you can run the following command in your project's root directory: npm install @actions/http-client@latest
