Loading vulnerability…
follow-redirects Proxy-Authorization Credential Leak
CVE-2024-28849 is an exposure-of-sensitive-information vulnerability in follow-redirects, a Node.js HTTP/HTTPS redirect-handling library. Affected versions remove the Authorization header when following a cross-domain redirect but do not similarly remove the Proxy-Authorization header. Consequently, proxy authentication credentials can be retained and forwarded during a cross-domain redirect.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to cause or control a cross-domain redirect may obtain proxy authentication credentials carried in the Proxy-Authorization header. Compromised credentials could enable unauthorized use of an affected proxy service and access to resources reachable through that proxy, subject to the permissions of the exposed credentials.
If you can’t patch tonight, do this now.
No workaround is known. Until upgrades are deployed, avoid supplying Proxy-Authorization credentials to requests that can follow untrusted or externally controlled redirects, and restrict outbound proxy authentication to trusted destinations where operationally feasible.
Patch, then assume compromise.
Upgrade follow-redirects to version 1.15.6 or later, which addresses the improper retention of the Proxy-Authorization header across cross-domain redirects. Update affected applications and bundled dependencies that include a vulnerable follow-redirects release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.