Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
This PR contains the following updates:
1.14.8
->1.15.6
GitHub Vulnerability Alerts
CVE-2023-26159
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
CVE-2024-28849
When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
Steps To Reproduce & PoC
Test code:
When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.
Impact
This vulnerability may lead to credentials leak.
Recommendations
Remove proxy-authentication header during cross-domain redirect
Recommended Patch
follow-redirects/index.js:464
Release Notes
follow-redirects/follow-redirects (follow-redirects)
### [`v1.15.6`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.5...v1.15.6) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.5...v1.15.6) ### [`v1.15.5`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.4...v1.15.5) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.4...v1.15.5) ### [`v1.15.4`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.3...v1.15.4) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.3...v1.15.4) ### [`v1.15.3`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.2...v1.15.3) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.2...v1.15.3) ### [`v1.15.2`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.1...v1.15.2) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.1...v1.15.2) ### [`v1.15.1`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.0...v1.15.1) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.15.0...v1.15.1) ### [`v1.15.0`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.14.9...v1.15.0) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.14.9...v1.15.0) ### [`v1.14.9`](https://togithub.com/follow-redirects/follow-redirects/compare/v1.14.8...v1.14.9) [Compare Source](https://togithub.com/follow-redirects/follow-redirects/compare/v1.14.8...v1.14.9)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.