CVE-2023-45289: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

Background

The impacted package is the Go standard library (stdlib) which provides a set of core packages for the Go programming language. The net/http package in the stdlib is responsible for handling HTTP requests and responses. It includes functionality for making HTTP requests, handling cookies, and managing headers. This vulnerability affects the behavior of the HTTP client when following redirects to domains that are not subdomain matches or exact matches of the initial domain.

Vulnerability Detail

The vulnerability arises from the incorrect forwarding of sensitive headers and cookies on HTTP redirects. When an HTTP redirect occurs to a domain that is not a subdomain match or exact match of the initial domain, the http.Client does not forward sensitive headers such as "Authorization" or "Cookie". This means that if a redirect goes from foo.com to www.foo.com, the Authorization header will be forwarded, but if the redirect goes to bar.com, the Authorization header will not be forwarded. An attacker could exploit this behavior by crafting a malicious HTTP redirect that causes sensitive headers to be unexpectedly forwarded. The impact of this vulnerability could include unauthorized access to protected resources or the exposure of sensitive information.

go get stdlib@vgo1.25.5

Workaround

There is no specific workaround provided for this vulnerability. However, developers can manually handle the forwarding of sensitive headers and cookies by inspecting the redirect response and manually including the necessary headers in subsequent requests. Here is an example of how this can be done using the net/http package:

package main

import (
	"fmt"
	"net/http"
)

func main() {
	client := &http.Client{}

	req, err := http.NewRequest("GET", "http://example.com", nil)
	if err != nil {
		fmt.Println(err)
		return
	}

	resp, err := client.Do(req)
	if err != nil {
		fmt.Println(err)
		return
	}

	if resp.StatusCode == http.StatusFound {
		location := resp.Header.Get("Location")
		if location != "" {
			req, err = http.NewRequest("GET", location, nil)
			if err != nil {
				fmt.Println(err)
				return
			}

			// Manually include sensitive headers in the new request
			req.Header.Set("Authorization", resp.Request.Header.Get("Authorization"))
			req.Header.Set("Cookie", resp.Request.Header.Get("Cookie"))

			resp, err = client.Do(req)
			if err != nil {
				fmt.Println(err)
				return
			}
		}
	}

	// Process the response
	// ...
}

Conclusion

In conclusion, the Go standard library (stdlib) is vulnerable to incorrect forwarding of sensitive headers and cookies on HTTP redirects. This vulnerability can be mitigated by updating to the recommended versions of the Go standard library. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ