CVE-2022-24719: Vulnerability in fluture-node
Summary
CVE-2022-24719: Forwarding of confidentials headers to third parties in fluture-node. Affects fluture-node versions >= 4.0.0, < 4.0.2. Fixed in 4.0.2. How to fix ↓
Also tracked for
- pyquest · PyPI
- request-util · PyPI
The same CVE-2022-24719 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fluture-node is an npm package that provides utilities for working with Future values in JavaScript. It offers various features and functions to handle asynchronous operations in a functional programming style. However, versions 4.0.0 and 4.0.1 of fluture-node are vulnerable to a security issue that involves the forwarding of confidential headers to third parties. This vulnerability can occur when using the followRedirects or followRedirectsWith functions with certain redirection strategies. If a request includes sensitive headers such as Authorization or Cookie, and the destination server redirects the request to a third-party domain or an unencrypted HTTP server on the same domain, the confidential headers will be included in the follow-up request and exposed to the third party or potential HTTP traffic sniffing.
Vulnerability Detail
The vulnerability in fluture-node 4.0.0 and 4.0.1 allows for the exposure of confidential headers to third parties or potential HTTP traffic sniffing. When using the affected versions of fluture-node with the followRedirects or followRedirectsWith functions, and a request contains sensitive headers, these headers are not properly redacted when following a redirect to another origin. As a result, the headers are included in the subsequent request and can be accessed by unauthorized parties. This poses a risk to the confidentiality of sensitive information, such as user credentials or session cookies.
How To Fix
Minimum fixed version
4.0.2
This is the first release that contains the fix.
npm install fluture-node@4.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 4.0.2 is not immediately feasible, a workaround is to use a custom redirection strategy via the followRedirectsWith function. This allows you to implement a custom strategy based on the new strategies available in fluture-node 4.0.2. By creating a custom strategy that properly redacts confidential headers when following redirects, you can mitigate the vulnerability until you can upgrade to the patched version.
Conclusion
In conclusion, the vulnerability in fluture-node versions 4.0.0 and 4.0.1 exposes confidential headers to third parties or potential HTTP traffic sniffing. To mitigate this vulnerability, it is recommended to upgrade to version 4.0.2 of fluture-node, which includes automatic redaction of confidential headers when following redirects. Alternatively, you can implement a custom redirection strategy that properly redacts the headers. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for fluture-node →
FAQ
The impact of this vulnerability is the exposure of confidential headers to third parties or potential HTTP traffic sniffing. Sensitive information, such as user credentials or session cookies, can be accessed by unauthorized parties.
To fix this vulnerability, it is recommended to upgrade to version 4.0.2 of fluture-node. This version includes automatic redaction of confidential headers when following a redirect to another origin.
Yes, if upgrading to version 4.0.2 is not immediately feasible, a workaround is to use a custom redirection strategy via the followRedirectsWith function. By creating a custom strategy that properly redacts confidential headers when following redirects, you can mitigate the vulnerability until you can upgrade to the patched version.
Yes, you can refer to the GitHub advisory for more details: https://github.com/advisories/GHSA-32x6-qvw6-mxj4
The severity of this vulnerability is rated as LOW with a CVSS score of 2.6.
