CVE-2022-0155: follow-redirects <=1.14.7 Information Exposure

CVE-2022-0155 in the follow-redirects package exposes private personal information to unauthorized actors through improper handling of redirects. The vulnerability arises when the package, without sufficient validation, follows redirects to domains that are not explicitly trusted. An attacker could craft a malicious URL that initially points to a legitimate site, but then redirects to a server controlled by the attacker. This attacker-controlled server could then serve content designed to extract sensitive information from the user's browser, such as cookies, authentication tokens, or other session data. The blast radius extends to any application utilizing the follow-redirects package and processing user-supplied URLs. This includes web applications, APIs, and any other service that relies on this package to handle redirects. The risk is particularly acute in scenarios where the application handles sensitive user data, such as financial information, healthcare records, or personally identifiable information (PII). An attacker gaining access to this data could use it for identity theft, fraud, or other malicious purposes. The severity is amplified if the application is used in a high-trust environment or processes data subject to regulatory compliance (e.g., GDPR, HIPAA).

1. Reserved2022-01-07
2. Published2022-01-10
3. Modified2024-08-02
4. EPSS updated2026-04-02

To address CVE-2022-0155, immediately upgrade the follow-redirects package to version 1.14.7 or later. This version includes a fix that properly validates redirect targets, preventing the vulnerability. If upgrading is not immediately feasible, a temporary workaround involves implementing strict URL validation and sanitization within your application code before passing URLs to the follow-redirects package. Specifically, verify that the redirect target domain is within a trusted list or matches an expected pattern. This should be done on the server-side to prevent client-side manipulation. Ensure that any URL parsing or manipulation is performed securely to avoid introducing new vulnerabilities. After applying the upgrade or workaround, thoroughly test your application to confirm that redirects are handled correctly and that sensitive information is not exposed. This testing should include scenarios where redirects are present and scenarios where they are absent. Consider using a security scanner to automatically identify potential redirect-related vulnerabilities.

Last updated

1.16.0recently