GHSA-558P-M34M-VPMQ

Vulnerability from github – Published: 2023-04-27 14:02 – Updated: 2023-05-05 21:40
VLAI?
Summary
Potential leak of authentication data to 3rd parties
Details

Impact

Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.

The flow of the vulnerability is as follows:

  1. Send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler
  2. The target host may return a redirection (3xx), with a link to a second host.
  3. The next request will use the credentials to authenticate with the second host, by setting the Authorization header.

The expected behavior is that the next request will NOT set the Authorization header.

Patches

The problem was fixed on April 1st 2020.

Workarounds

There is no workaround.

References

This is similar to the following issues in nature: 1. HTTP authentication leak in redirects - I used the same solution as CURL did. 2. CVE-2018-1000007.

Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "typed-rest-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30846"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-27T14:02:11Z",
    "nvd_published_at": "2023-04-26T21:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nUsers of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. \n\nThe flow of the vulnerability is as follows:\n\n1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler` \n2. The target host may return a redirection (3xx), with a link to a second host.\n3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.\n\nThe expected behavior is that the next request will *NOT* set the `Authorization` header.\n\n\n### Patches\nThe problem was fixed on April 1st 2020.\n\n\n### Workarounds\nThere is no workaround.\n\n### References\nThis is similar to the following issues in nature:\n1. [HTTP authentication leak in redirects](https://curl.haxx.se/docs/CVE-2018-1000007.html) - I used the same solution as CURL did.\n2. [CVE-2018-1000007](https://nvd.nist.gov/vuln/detail/CVE-2018-1000007).",
  "id": "GHSA-558p-m34m-vpmq",
  "modified": "2023-05-05T21:40:11Z",
  "published": "2023-04-27T14:02:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30846"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/typed-rest-client/pull/207"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/typed-rest-client"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230601-0008"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Potential leak of authentication data to 3rd parties"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.