CVE-2024-28849

MEDIUM6.5EPSS 1.1%

follow-redirects' Proxy-Authorization header kept across hosts

Published: 3/14/2024Modified: 2/4/2026
Also known as:GHSA-cxjh-pqwp-8mfpCGA-4vmv-7rfh-8q9h

Description

When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too. ## Steps To Reproduce & PoC Test code: ```js const axios = require('axios'); axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' } }) .then((response) => { console.log(response); }) ``` When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept. ## Impact This vulnerability may lead to credentials leak. ## Recommendations Remove proxy-authentication header during cross-domain redirect ### Recommended Patch [follow-redirects/index.js:464](https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b) ```diff - removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers); + removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers); ```

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (9)