Header Leakage on Cross-Domain Redirects in amphp/http-client
Summary
GHSA-8jp9-mpv9-98rj: amphp/http-client Header leakage on cross-domain redirects. Affects amphp/http-client versions >= 4.0.0, < 4.4.0. Fixed in 4.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
amphp/http-client is a package available on Packagist that provides an asynchronous HTTP client for PHP applications. It allows developers to send HTTP requests and handle responses in an efficient and non-blocking manner. However, a security weakness has been identified in versions 4.0.0 to 4.3.0 of the package, which could lead to the leakage of sensitive request headers during cross-domain redirects.
Vulnerability Detail
The vulnerability in amphp/http-client arises from the incorrect removal of headers when handling cross-domain redirects. When a redirect occurs from one domain to another, certain request headers that should be removed are not properly cleared. This can result in the leakage of sensitive information contained in those headers to the redirected host. The issue specifically lies in the Message::setHeaders method, which fails to replace the entire set of headers but only operates on headers matching the given array keys. The impact of this vulnerability could vary depending on the nature of the leaked headers, but it has the potential to expose sensitive data to unauthorized parties.
How To Fix
Minimum fixed version
4.4.0
This is the first release that contains the fix.
composer require amphp/http-client:4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the fixed version of amphp/http-client (4.4.0 or later).
Conclusion
The vulnerability in amphp/http-client that causes header leakage on cross-domain redirects can be mitigated by upgrading to version 4.4.0 or later. This fix ensures that all headers are correctly removed, preventing any potential leakage of sensitive information. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for amphp/http-client →
FAQ
amphp/http-client is a package that provides an asynchronous HTTP client for PHP applications. It allows developers to send HTTP requests and handle responses in a non-blocking manner, improving performance and efficiency.
The vulnerability in amphp/http-client could lead to the leakage of sensitive request headers during cross-domain redirects. This could potentially expose sensitive information to unauthorized parties.
Versions 4.0.0 to 4.3.0 of amphp/http-client are affected by this vulnerability.
To fix this vulnerability, you should upgrade to version 4.4.0 or later of amphp/http-client. This ensures that all headers are correctly removed during cross-domain redirects.
No specific workaround is provided for this vulnerability. The recommended solution is to upgrade to the fixed version of amphp/http-client.
References
Related vulnerabilities
Recent vulnerabilities recorded for amphp/http-client.
