Credentials Leak Vulnerability in node-follow-redirects Package
Summary
DEBIAN-CVE-2024-28849: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Affects node-follow-redirects versions < 1.15.6+~1.14.4-1. Fixed in 1.15.6+~1.14.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-follow-redirects package is an open-source library that serves as a drop-in replacement for Node.js's built-in http and https modules. It is designed to automatically follow HTTP redirects, making it easier for developers to handle web requests that involve redirection. However, certain versions of this package have a vulnerability that could expose sensitive credentials during cross-domain redirects.
Vulnerability Detail
The vulnerability arises from the way the node-follow-redirects package handles authorization headers during redirects. In affected versions, while the authorization header is cleared during cross-domain redirects, the proxy-authentication header, which may contain sensitive credentials, is retained. This oversight can lead to a potential leak of credentials, exposing users to security risks. The issue has been identified and addressed in version 1.15.6 of the package.
How To Fix
Minimum fixed version
1.15.6+~1.14.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-follow-redirectsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The recommended action is to upgrade to the patched version of the package.
Conclusion
The node-follow-redirects package has a significant vulnerability that can lead to credential leaks during cross-domain redirects. Users are strongly advised to upgrade to version 1.15.6 or later to mitigate this risk. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for node-follow-redirects →
FAQ
node-follow-redirects is a library that allows Node.js applications to automatically follow HTTP and HTTPS redirects.
Versions prior to 1.15.6 are affected by this vulnerability.
The main risk is the potential leak of sensitive credentials through the proxy-authentication header during cross-domain redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-follow-redirects.
