Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects

The core of this vulnerability lies in the follow-redirects package's handling of sensitive data during redirection processes. Specifically, the package fails to adequately sanitize or remove sensitive information (such as authentication tokens, API keys, or personally identifiable information) before storing or transferring it. An attacker could potentially exploit this by crafting malicious URLs that trigger redirection chains, leading to the unintentional leakage of this sensitive data. The blast radius is primarily limited to applications directly using the follow-redirects package, but the potential for data exposure necessitates prompt remediation. While the CVSS score is LOW, the sensitivity of the data potentially exposed warrants careful attention.

Node.js developers and organizations utilizing the follow-redirects package in their projects are at risk. This includes applications that heavily rely on redirection functionality, such as web scraping tools, API clients, and proxy servers. Projects using older versions of Node.js or those with complex dependency management systems are particularly vulnerable.

• nodejs / supply-chain:

  npm list follow-redirects

If the output shows a version <= 1.14.8, the system is vulnerable. • nodejs / supply-chain:

npm audit follow-redirects

This command will identify vulnerable dependencies in your project. • generic web: Examine application logs for unusual redirection patterns or requests containing sensitive data in URL parameters. Look for patterns indicative of attempted data exfiltration.

1. 2022-02-09Disclosure

   disclosure

1. 已保留2022-02-08
2. 发布日期2022-02-09
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-0536 is to upgrade the follow-redirects package to version 1.14.8 or later. This version includes the necessary fixes to properly handle sensitive data during redirection. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and output sanitization within your application to minimize the risk of data exposure. While a WAF or proxy cannot directly address this vulnerability, they can be configured to inspect and filter potentially malicious URLs. After upgrading, confirm the fix by testing redirection flows with known sensitive data to ensure it is not being inadvertently exposed.

最后更新

1.16.0最近