Sensitive Header Leakage in Golang HTTP Client Due to Cross-Domain Redirects
Summary
CVE-2024-45336: Sensitive headers incorrectly sent after cross-domain redirect in net/http. Affects golang across 3 version ranges.
< 1.22.11
>= 1.23.0-0, < 1.23.5
>= 1.24.0-0, < 1.24.0
Fixed in 1.22.11, 1.23.5 or 1.24.0, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-45336 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other networked applications. The HTTP client in Golang is a critical component that facilitates communication between applications over the internet. However, it has a vulnerability that affects how sensitive headers, such as Authorization, are handled during cross-domain redirects, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the Golang HTTP client's handling of sensitive headers when following redirects. Specifically, when a request is made to a domain (e.g., a.com) with an Authorization header, and that request is redirected to a different domain (e.g., b.com), the Authorization header is not sent to the new domain. This behavior can lead to unauthorized access if sensitive information is inadvertently exposed. Furthermore, if there are subsequent redirects within the same domain, the headers are restored, which can create confusion and potential security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.111.22.11 -
>= 1.23.0-0, < 1.23.51.23.5 -
>= 1.24.0-0, < 1.24.01.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using sensitive headers in requests that may be redirected to different domains. Instead, consider implementing token-based authentication or other secure methods that do not rely on passing sensitive information through headers.
Conclusion
The Golang HTTP client vulnerability concerning the handling of sensitive headers during cross-domain redirects poses a significant security risk. It is crucial for developers to update their Golang packages to the latest patched versions to mitigate this risk. Additionally, employing workarounds can help protect sensitive information until an update can be applied.
See every vulnerability recorded for golang →
FAQ
The impact includes the potential exposure of sensitive information, such as authorization tokens, to unauthorized domains, leading to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 1.22.11, 1.23.5, and 1.24.0-rc2 are affected by this vulnerability.
Yes, updating to the specified patched versions of Golang will permanently fix the vulnerability.
If an immediate update is not possible, implement a workaround by avoiding the use of sensitive headers in cross-domain requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
