Credentials Leak Vulnerability in node-follow-redirects Package
Summary
CVE-2024-28849: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Affects node-follow-redirects versions < c4f847f85176991f95ab9c88af63b1294de8649b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-follow-redirects package is an open-source library designed to serve as a drop-in replacement for Node.js's native http and https modules. It automatically follows HTTP redirects, making it easier for developers to handle web requests without manually managing redirections. However, this convenience comes with a security risk, as certain versions of the package do not adequately clear sensitive authorization headers during cross-domain redirects.
Vulnerability Detail
The vulnerability identified as CVE-2024-28849 arises from the node-follow-redirects package's failure to clear the proxy-authentication header during cross-domain redirects. While the authorization header is cleared, the proxy-authentication header, which may contain sensitive credentials, is retained. This oversight can lead to the unintended exposure of user credentials, potentially allowing malicious actors to exploit this information. The issue has been addressed in version 1.15.6 of the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to upgrade to the patched version of the package.
Conclusion
The CVE-2024-28849 vulnerability in the node-follow-redirects package poses a significant risk by potentially exposing sensitive credentials through improper handling of headers during redirects. Users are strongly advised to upgrade to version 1.15.6 or later to safeguard their applications against this vulnerability.
See every vulnerability recorded for node-follow-redirects →
FAQ
CVE-2024-28849 is a vulnerability in the node-follow-redirects package that allows sensitive credentials to be leaked due to improper handling of the proxy-authentication header during cross-domain redirects.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, like package-lock.json, you can check if your application is affected by CVE-2024-28849.
All versions of the node-follow-redirects package prior to 1.15.6 are affected by this vulnerability.
Unfortunately, there are no workarounds available. The only way to mitigate this issue is to upgrade to version 1.15.6 or later.
If an immediate upgrade is not possible, consider reviewing your application's use of the node-follow-redirects package and assess the risk of potential credential leaks until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for node-follow-redirects.
