http.from-superagent: Credentials Forwarding & Blocklist Bypass Vulnerabilities (v<2.8.0)

Vulnerability Summary Overview This page discloses two critical security vulnerabilities related to the package: 1. Issue 2: Credentials forwarded across origins on redirect Description: When making cross-origin requests using , if the server returns a redirect response (e.g., 302), the client forwards the original request's credentials (such as Cookies, Authorization headers) to the new target domain. This can lead to credential leakage to malicious servers. Root Cause: The redirect handling logic fails to properly clear or block the cross-origin forwarding of credentials. Impact Scope: All applications using for cross-origin requests that may encounter redirects. Remediation: Upgrade to version 2.8.0 of . 2. Issue 2: Blocklist bypass via trailing dot Description: Attackers can bypass domain-based blocklists by appending a dot ( ) to the end of the domain name. For example, if the blocklist contains , an attacker can request to bypass the check. Root Cause: Domain names are not normalized (e.g., trailing dots are not removed) during comparison. Impact Scope: All applications relying on for domain blocklist checks. Remediation: Upgrade to version 2.8.0 of . Impact Scope Affected Package: Affected Versions: All versions lower than 2.8.0. CVSS Scores: Credential Forwarding Vulnerability: 7.7 / 10 (High) Blocklist Bypass Vulnerability: 5.3 / 10 (Medium) Remediation Immediate Upgrade: Upgrade the package to version 2.8.0 or higher. Temporary Mitigation: For the credential forwarding issue: Avoid using sensitive credentials in cross-origin requests, or handle redirects manually at the application layer. For the blocklist bypass issue: Normalize domain names (remove trailing dots) at the application layer before performing blocklist checks. POC Code / Exploit Code Credential Forwarding Vulnerability POC Blocklist Bypass Vulnerability POC > Important Note**: The POC code above is for demonstrating vulnerability principles only. Do not use it in production environments. In actual attacks, attackers exploit these vulnerabilities to steal user credentials or bypass security policies.

Goal Reached Thanks to every supporter — we hit 100%!

http.from-superagent: Credentials Forwarding & Blocklist Bypass Vulnerabilities (v<2.8.0)

More from this source