Description
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Go standard library / net/http0 – 1.21.8
- Go standard library / net/http1.22.0-0 – 1.22.1
- Go standard library / net/http/cookiejar0 – 1.21.8
- Go standard library / net/http/cookiejar1.22.0-0 – 1.22.1
Updated 27m ago · 8 sources