GHSA-F27P-CMV8-XHM6

Vulnerability from github – Published: 2025-01-06 22:27 – Updated: 2025-01-07 02:52
VLAI?
Summary
fetch: Authorization headers not dropped when redirecting cross-origin
Details

Summary

When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.

Details

The right behavior would be to drop the Authorization header instead, in this scenario. The same is generally applied to Cookie and Proxy-Authorization headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as "origin".

The documentation states:

Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno does not need to protect against leaking authenticated data cross origin

Reproduction

const ac = new AbortController()

const server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) => {
  return new Response(null, {
    status: 302,
    headers: {
      'location': 'http://localhost:3002/redirected'
    },
  })
})

const server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) => {
  const body = JSON.stringify({
    url: req.url,
    hasAuth: req.headers.has('authorization'),
  })
  return new Response(body, {
    status: 200,
    headers: {'content-type': 'application/json'},
  })
})

async function main() {
  const response = await fetch("http://localhost:3001/", {
    headers: {authorization: 'Bearer foo'}
  })
  const body = await response.json()

  ac.abort()

  if (body.hasAuth) {
    console.error('ERROR: Authorization header should not be present after cross-origin redirect')
  } else {
    console.log('SUCCESS: Authorization header is not present after cross-origin redirect')
  }
}

setTimeout(main, 500)
Severity ?
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deno_fetch"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.1"
            },
            {
              "fixed": "0.204.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.46.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-21620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-06T22:27:09Z",
    "nvd_published_at": "2025-01-06T23:15:07Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nWhen you send a request with the `Authorization` header to one domain, and the response asks to redirect to a different domain, Deno\u0027s`fetch()` redirect handling creates a follow-up redirect request that keeps the original `Authorization` header, leaking its content to that second domain.\n\n\n### Details\n\nThe [right behavior](https://fetch.spec.whatwg.org/#ref-for-cors-non-wildcard-request-header-name) would be to drop the `Authorization` header instead, in this scenario. The same is generally applied to `Cookie` and `Proxy-Authorization` headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as \"origin\".\n\nThe [documentation](https://docs.deno.com/runtime/reference/web_platform_apis/#:~:text=Deno%20does%20not%20follow%20the,leaking%20authenticated%20data%20cross%20origin.) states: \n\u003e Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno **does not need** to protect against leaking authenticated data cross origin \n\n### Reproduction\n```ts\nconst ac = new AbortController()\n\nconst server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) =\u003e {\n  return new Response(null, {\n    status: 302,\n    headers: {\n      \u0027location\u0027: \u0027http://localhost:3002/redirected\u0027\n    },\n  })\n})\n\nconst server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) =\u003e {\n  const body = JSON.stringify({\n    url: req.url,\n    hasAuth: req.headers.has(\u0027authorization\u0027),\n  })\n  return new Response(body, {\n    status: 200,\n    headers: {\u0027content-type\u0027: \u0027application/json\u0027},\n  })\n})\n\nasync function main() {\n  const response = await fetch(\"http://localhost:3001/\", {\n    headers: {authorization: \u0027Bearer foo\u0027}\n  })\n  const body = await response.json()\n  \n  ac.abort()\n  \n  if (body.hasAuth) {\n    console.error(\u0027ERROR: Authorization header should not be present after cross-origin redirect\u0027)\n  } else {\n    console.log(\u0027SUCCESS: Authorization header is not present after cross-origin redirect\u0027)\n  }\n}\n\nsetTimeout(main, 500)\n```\n",
  "id": "GHSA-f27p-cmv8-xhm6",
  "modified": "2025-01-07T02:52:55Z",
  "published": "2025-01-06T22:27:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21620"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/denoland/deno"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fetch: Authorization headers not dropped when redirecting cross-origin"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.