CVE-2022-24719: Fluture-Node HTTP Header Exposure
Summary
CVE-2022-24719: Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Affects pyquest across 2 version ranges.
< 0c99bc511533d48be17dc6bfe641f7d0aeb34d77
< 125e4474f910c1507f8ec3232848626fbc0f55c4
Fixed in 0c99bc511533d48be17dc6bfe641f7d0aeb34d77. How to fix ↓
Also tracked for
- fluture-node · npm
- request-util · PyPI
The same CVE-2022-24719 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fluture-Node is a functional programming-style HTTP and streaming utility for Node.js. It is built on top of Fluture and provides various features for handling HTTP requests and responses. Fluture-Node versions 4.0.0 and 4.0.1 are affected by a vulnerability that exposes confidential headers, such as Authorization or Cookie, when using the followRedirects or followRedirectsWith functions. This vulnerability occurs when a request with confidential headers is redirected to a third-party domain or an unencrypted HTTP server on the same domain. The headers are included in the follow-up request, potentially exposing them to the third party or allowing for HTTP traffic sniffing. Fluture-Node version 4.0.2 introduced automatic redaction of confidential headers when following redirects to another origin.
Vulnerability Detail
The vulnerability in Fluture-Node versions 4.0.0 and 4.0.1 allows for the exposure of confidential headers in certain redirect scenarios. This can lead to unauthorized access to sensitive information or the interception of confidential data. The issue arises when a request containing confidential headers is redirected to a different domain or an unencrypted HTTP server on the same domain. The headers are included in the subsequent request, potentially exposing them to unauthorized parties or allowing for interception through HTTP traffic sniffing. Fluture-Node version 4.0.2 addresses this vulnerability by automatically redacting confidential headers when following redirects to another origin.
How To Fix
Minimum fixed version
0c99bc511533d48be17dc6bfe641f7d0aeb34d77
This is the first release that contains the fix.
pip install --upgrade "pyquest==0c99bc511533d48be17dc6bfe641f7d0aeb34d77"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Fluture-Node version 4.0.2 is not immediately feasible, a workaround can be implemented by using a custom redirection strategy with the followRedirectsWith function. By creating a custom strategy based on the new strategies available in Fluture-Node 4.0.2, it is possible to ensure that confidential headers are redacted when following redirects. This workaround provides a temporary solution until the package can be updated to the latest version.
Conclusion
Fluture-Node versions 4.0.0 and 4.0.1 are vulnerable to the exposure of confidential headers during certain redirect scenarios. Upgrading to version 4.0.2 or later is recommended to fix this vulnerability. Alternatively, a workaround can be implemented by using a custom redirection strategy. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyquest →
FAQ
Fluture-Node is a functional programming-style HTTP and streaming utility for Node.js. It provides features for handling HTTP requests and responses in a functional manner.
Versions 4.0.0 and 4.0.1 of Fluture-Node are affected by this vulnerability.
This vulnerability exposes confidential headers, such as Authorization or Cookie, when a request is redirected to a third-party domain or an unencrypted HTTP server on the same domain. This can lead to unauthorized access to sensitive information or interception of confidential data.
To fix this vulnerability, it is recommended to upgrade to Fluture-Node version 4.0.2 or later. This version includes automatic redaction of confidential headers when following redirects.
Yes, a workaround is available by using a custom redirection strategy with the followRedirectsWith function. By creating a custom strategy based on the new strategies in Fluture-Node 4.0.2, confidential headers can be redacted when following redirects.
