Bug 1221456

Summary: VUL-0: CVE-2024-28849: velociraptor: follow-redirects: possible credential leak
Product: [Novell Products] SUSE Security Incidents Reporter: Andrea Mattiazzo <andrea.mattiazzo>
Component: IncidentsAssignee: Antonio Teixeira <antonio.teixeira>
Status: IN_PROGRESS --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: andrea.mattiazzo, camila.matos, security-team, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/397689/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1221450    

Description Andrea Mattiazzo 2024-03-15 09:46:26 UTC 
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28849
https://www.cve.org/CVERecord?id=CVE-2024-28849
https://fetch.spec.whatwg.org/#authentication-entries
https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
https://github.com/psf/requests/issues/1885
https://hackerone.com/reports/2390009
https://bugzilla.redhat.com/show_bug.cgi?id=2269576

Patch:
https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b
Comment 1 Andrea Mattiazzo 2024-03-15 09:47:53 UTC 
A vulnerable version of follow-redirects was found inside velociraptor:

openSUSE:Factory/velociraptor                follow-redirects (1.15.0)
SUSE:ALP:Source:Standard:1.0/velociraptor    follow-redirects (1.15.0)
Comment 3 Antonio Teixeira 2024-04-19 11:42:25 UTC 
I added a patch to fix this to the Factory package as part of this:
https://build.opensuse.org/request/show/1165646
(There are many changes. For the relevant patch see CVE-2024-28849-follow-redirects-drop-proxy-authorization.patch)

Fix has been sent to ALP codestream in request 327528