From 3f6f4bb4c0ac65688908a40739cc6886963d9144 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=82=B9=E3=83=BC=E3=83=81=E3=83=BB=E3=83=95=E3=82=A1?= =?UTF-8?q?=E3=83=88=E3=83=9E=E3=83=AF=E3=83=86=E3=82=A3?= Date: Thu, 25 Apr 2024 02:23:47 +0700 Subject: [PATCH] fix(security): update follow-redirects When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too. ## Steps To Reproduce & PoC ```js const axios = require('axios'); axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' } }) .then((response) => { console.log(response); }) ``` When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept. ```diff - removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers); + removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers); ``` CWE-200 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N` CVE-2024-28849 --- packages/terminal/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/terminal/package-lock.json b/packages/terminal/package-lock.json index 65eb2766..047ead51 100644 --- a/packages/terminal/package-lock.json +++ b/packages/terminal/package-lock.json @@ -673,9 +673,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.15.5", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz", - "integrity": "sha512-vSFWUON1B+yAw1VN4xMfxgn5fTUiaOzAJCKBwIIgT/+7CuGy9+r+5gITvP62j3RmaD5Ph65UaERdOSRGUzZtgw==", + "version": "1.15.6", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz", + "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==", "dev": true, "funding": [ {