follow-redirects' Proxy-Authorization header kept across hosts

The primary impact of CVE-2024-28849 is the potential exposure of credentials transmitted via the Proxy-Authorization header. An attacker controlling a malicious intermediary server (e.g., a rogue proxy) can intercept requests and responses during cross-domain redirects. Because the Proxy-Authorization header is not properly cleared, it is included in the redirected request, allowing the attacker to steal the credentials. This could enable the attacker to impersonate the user or application, gaining unauthorized access to internal resources. The blast radius extends to any application using Axios with the vulnerable follow-redirects version and relying on proxy authentication. While not directly exploitable for remote code execution, the credential theft can be a stepping stone for further attacks.

最終更新

1.16.0最近

1. 予約済み2024-03-11
2. 公開日2024-03-14
3. 更新日2026-02-04
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-28849 is to upgrade the follow-redirects dependency to version 1.15.6 or later. This version includes a fix that properly clears both the Authorization and Proxy-Authorization headers during cross-domain redirects. If upgrading Axios directly is not feasible due to compatibility issues, consider implementing a temporary workaround by filtering or removing the Proxy-Authorization header before sending requests. This can be achieved using a reverse proxy or a custom middleware. Implement WAF rules to detect and block requests containing sensitive headers in redirects. After upgrading, confirm the fix by sending a request with a Proxy-Authorization header through a cross-domain redirect and verifying that the header is not present in the redirected response.