CVE-2024-28849

When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.

Steps To Reproduce & PoC

Test code:

const axios = require('axios');

axios.get('http://127.0.0.1:10081/', {
 headers: {
 'AuThorization': 'Rear Test',
 'ProXy-AuthoriZation': 'Rear Test',
 'coOkie': 't=1'
 }
})
 .then((response) => {
 console.log(response);
 })

When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.

Impact

This vulnerability may lead to credentials leak.

Recommendations

Remove proxy-authentication header during cross-domain redirect

Recommended Patch

follow-redirects/index.js:464

- removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
+ removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers);

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 0.0.3-tuxcare.1.

TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.0.0-tuxcare.3.

TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.

TuxCare rebuilt follow-redirects to address 3 CVEs. Fixed in 1.15.5-tuxcare.1.

TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.3-tuxcare.1.

TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.2-tuxcare.1.

TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. (CVE-2024-28849) Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse. (CVE-2025-62727) Security restriction bypass via malformed HTTP Host header. (CVE-2026-48710)

These are all security issues fixed in the system-user-velociraptor-1.0.0-5.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that follow-redirects did not properly protect sensitive user information during redirects. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)

It was discovered that follow-redirects did not properly remove sensitive information before storage or transfer. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)

It was discovered that follow-redirects did not properly validate URLs when handling certain inputs. An attacker could possibly use this issue to redirect users to a malicious site, resulting in information disclosure or phishing attacks. (CVE-2023-26159)

It was discovered that follow-redirects did not properly clear proxy authentication headers during cross-domain redirects. An attacker could possibly use this issue to cause exposure of sensitive credentials. (CVE-2024-28849)