CVE-2023-45289: stdlib - Incorrect Forwarding of Sensitive Headers and Cookies on HTTP Redirect
Summary
CVE-2023-45289: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". Affects golang-1.15 versions 1.15.15-1 – 1.15.9-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package is a standard library in the Go programming language. It provides a set of common functions and utilities for various tasks. The vulnerability in this package affects the net/http/cookiejar module, which is responsible for managing cookies in HTTP requests. This vulnerability allows an http.Client to incorrectly forward sensitive headers and cookies when following an HTTP redirect to a domain that is not a subdomain match or exact match of the initial domain.
Vulnerability Detail
The vulnerability arises from the fact that when an HTTP redirect occurs to a different domain, the http.Client fails to forward sensitive headers such as "Authorization" or "Cookie". This means that if a redirect goes from foo.com to www.foo.com, the Authorization header will be forwarded, but if the redirect goes to bar.com, the header will not be forwarded. An attacker could exploit this by crafting a malicious HTTP redirect, causing sensitive headers to be unexpectedly forwarded. The impact of this vulnerability could lead to unauthorized access or leakage of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the stdlib package to the fixed versions mentioned above.
Conclusion
The stdlib package in Go is vulnerable to incorrect forwarding of sensitive headers and cookies on HTTP redirects. This could result in unauthorized access or leakage of sensitive information. It is crucial to update the package to the fixed versions (1.21.8 or 1.22.1) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability could lead to unauthorized access or leakage of sensitive information due to the incorrect forwarding of sensitive headers and cookies on HTTP redirects.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes the manifest file (e.g., package-lock.json) and provides real-time alerts for open-source vulnerabilities.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the fix promptly to mitigate the risk.
Yes, the CVSS score for this vulnerability is 5.3, indicating a medium severity level.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2023-45289
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
