CVE-2018-1000007
published 2018-01-24CVE-2018-1000007: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
8.03%
94.1th percentile
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
Affected
61 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| benoitc | hackney | >= 3.1.1 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 3.1.1 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 3.1.1 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= e61b7d04b7826847e1efe614106ef4d580c78eab < c58d5b50bade146360b85caf3dc8065807b08246 | c58d5b50bade146360b85caf3dc8065807b08246 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | curl | < curl 7.58.0-1 (bookworm) | curl 7.58.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | gradle | — | — |
| debian | puppet | — | — |
| debian | puppet-agent | — | — |
| debian | puppetserver | — | — |
| debian | wget | — | — |
| fedoraproject | fedora | — | — |
| fujitsu | m10-1_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-1_firmware | < xcp3070 | xcp3070 |
| fujitsu | m10-4_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-4_firmware | < xcp3070 | xcp3070 |
| fujitsu | m10-4s_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-4s_firmware | < xcp3070 | xcp3070 |
| fujitsu | m12-1_firmware | < xcp2361 | xcp2361 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
cvelistv5v4.09.8CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_msrc6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
ghsa·2026-06-26·CVSS 9.8
CVE-2026-47070 [CRITICAL] CWE-601 Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
### Summary
The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When `follow_redirect` is enabled and a server responds with a cross-origin `Location`, hackney delivers the caller's credentials verbatim to the attacker-controlled host. The main hackney HTTP/1 client has `maybe_strip_auth_on_redirect/2` (the fix for CVE-2018-1000007); the H3 client was added later without it.
### Details
In `src/hackney_h3.erl`, `handle_redirect/11` (line 165) extracts the redirect target from the server-
CVEList
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
cvelistv5·2026-05-25·CVSS 9.8
CVE-2026-47070 [CRITICAL] CWE-601 HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.
The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection
OSV
Potential leak of authentication data to 3rd parties
osv·2023-04-27·CVSS 9.8
CVE-2023-30846 [CRITICAL] Potential leak of authentication data to 3rd parties
Potential leak of authentication data to 3rd parties
### Impact
Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.
The flow of the vulnerability is as follows:
1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`
2. The target host may return a redirection (3xx), with a link to a second host.
3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.
The expected behavior is that the next request will *NOT* set the `Authorization` header.
### Patches
The problem was fixed on April 1st 2020.
### Workarounds
There is no workaround.
### References
This is similar to the following issues in na
GHSA
Potential leak of authentication data to 3rd parties
ghsa·2023-04-27·CVSS 9.8
CVE-2023-30846 [CRITICAL] CWE-522 Potential leak of authentication data to 3rd parties
Potential leak of authentication data to 3rd parties
### Impact
Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.
The flow of the vulnerability is as follows:
1. Send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`
2. The target host may return a redirection (3xx), with a link to a second host.
3. The next request will use the credentials to authenticate with the second host, by setting the `Authorization` header.
The expected behavior is that the next request will *NOT* set the `Authorization` header.
### Patches
The problem was fixed on April 1st 2020.
### Workarounds
There is no workaround.
### References
This is similar to the following issues in na
OSV
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
osv·2022-07-21·CVSS 9.8
CVE-2022-31151 [CRITICAL] undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
### Impact
Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.
However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd part
GHSA
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
ghsa·2022-07-21·CVSS 9.8
CVE-2022-31151 [CRITICAL] CWE-346 undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
### Impact
Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.
However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd part
GHSA
GHSA-xx6j-wqj7-mrv3: The HTTP client in the Build tool in Gradle before 5
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2019-15052 [CRITICAL] CWE-522 GHSA-xx6j-wqj7-mrv3: The HTTP client in the Build tool in Gradle before 5
The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
GHSA
GHSA-78qj-768g-464g: GNU Wget through 1
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2021-31879 [CRITICAL] CWE-601 GHSA-78qj-768g-464g: GNU Wget through 1
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
GHSA
GHSA-g7x2-hrfp-pv5f: libcurl 7
ghsa_unreviewed·2022-04-30
CVE-2018-1000007 [CRITICAL] GHSA-g7x2-hrfp-pv5f: libcurl 7
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
GHSA
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
ghsa·2021-12-02·CVSS 9.8
CVE-2021-27023 [CRITICAL] Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
OSV
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
osv·2021-12-02·CVSS 9.8
CVE-2021-27023 [CRITICAL] Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
OSV
CVE-2021-27023: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different hos
osv·2021-11-18·CVSS 9.8
CVE-2021-27023 [CRITICAL] CVE-2021-27023: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different hos
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
OSV
CVE-2021-31879: GNU Wget through 1
osv·2021-04-29·CVSS 9.8
CVE-2021-31879 [CRITICAL] CVE-2021-31879: GNU Wget through 1
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
OSV
CVE-2019-15052: The HTTP client in Gradle before 5
osv·2019-08-14·CVSS 9.8
CVE-2019-15052 [CRITICAL] CVE-2019-15052: The HTTP client in Gradle before 5
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
OSV
curl vulnerabilities
osv·2018-01-31·CVSS 9.8
CVE-2018-1000007 [CRITICAL] curl vulnerabilities
curl vulnerabilities
It was discovered that curl incorrectly handled certain data. An attacker
could possibly use this to cause a denial of service or even to get access
to sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
It was discovered that curl could accidentally leak authentication data.
An attacker could possibly use this to get access to sensitive information.
(CVE-2018-1000007)
OSV
CVE-2018-1000007: libcurl 7
osv·2018-01-24·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007: libcurl 7
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
Red Hat
puppet: unsafe HTTP redirect
vendor_redhat·2021-11-09·CVSS 9.8
CVE-2021-27023 [CRITICAL] CWE-200 puppet: unsafe HTTP redirect
puppet: unsafe HTTP redirect
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
An exposure flaw was found in Puppet Agent and Puppet Server where HTTP credentials were leaked. When the HTTP redirects occurred, the authentication and cookie header was added when following redirects to a different host. This flaw allows an unauthorized network attacker to access sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Statement: Red Hat Satellite 6.8 and earlier versions are not affected by this vulnerability.
Package: puppet (Red Hat OpenStack Platform 10 (Newton)) - Not affected
Package: puppet (Red Hat
Microsoft
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin a related issue to CVE-2018-1000007.
vendor_msrc·2021-04-13·CVSS 6.1
CVE-2021-31879 [CRITICAL] CWE-601 GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin a related issue to CVE-2018-1000007.
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin a related issue to CVE-2018-1000007.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer
Debian
CVE-2021-27023: puppet - A flaw was discovered in Puppet Agent and Puppet Server that may result in a lea...
vendor_debian·2021·CVSS 9.8
CVE-2021-27023 [CRITICAL] CVE-2021-27023: puppet - A flaw was discovered in Puppet Agent and Puppet Server that may result in a lea...
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Scope: local
bullseye: open
Debian
CVE-2021-31879: wget - GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect t...
vendor_debian·2021·CVSS 9.8
CVE-2021-31879 [CRITICAL] CVE-2021-31879: wget - GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect t...
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Red Hat
wget: authorization header disclosure on redirect
vendor_redhat·2019-10-04·CVSS 9.8
CVE-2021-31879 [CRITICAL] CWE-200 wget: authorization header disclosure on redirect
wget: authorization header disclosure on redirect
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
A flaw was found in wget. If wget sends an Authorization header as part of a query and receives an HTTP REDIRECT to a third party in return, the Authorization header will be forwarded as part of the redirected request. This issue creates a password leak, as the second server receives the password. The highest threat from this vulnerability is confidentiality.
Mitigation: Use `--max-redirect 0` when the request contains Authorization header to prevent wget to redirect the request.
Package: wget (Red Hat Enterprise Linux 6) - Out of support scope
Package: wget (Red Hat Enterprise Linux 7) - Out of sup
Red Hat
gradle: sends authentication credentials originally destined for the configured host
vendor_redhat·2019-08-14·CVSS 9.8
CVE-2019-15052 [CRITICAL] CWE-522 gradle: sends authentication credentials originally destined for the configured host
gradle: sends authentication credentials originally destined for the configured host
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
A flaw was found in Gradle, where the HTTP client sends credentials originally meant for the configured host, to all subsequent hosts that the request redirects. This flaw allows a leak of the authentication token to external entities.
Package: gradle (Red Hat Fuse 7) - Not affected
Package: gradle (Red Hat JBoss Web Server 3) - Not affected
Debian
CVE-2019-15052: gradle - The HTTP client in Gradle before 5.6 sends authentication credentials originally...
vendor_debian·2019·CVSS 9.8
CVE-2019-15052 [CRITICAL] CVE-2019-15052: gradle - The HTTP client in Gradle before 5.6 sends authentication credentials originally...
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Ubuntu
curl vulnerability
vendor_ubuntu·2018-02-01·CVSS 9.8
CVE-2018-1000007 [CRITICAL] curl vulnerability
Title: curl vulnerability
Summary: curl could be made to expose sensitive information.
USN-3554-1 fixed vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that curl could accidentally leak authentication data.
An attacker could possibly use this to get access to sensitive information.
(CVE-2018-1000007)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2018-01-31·CVSS 9.8
CVE-2018-1000005 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
It was discovered that curl incorrectly handled certain data. An attacker
could possibly use this to cause a denial of service or even to get access
to sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
It was discovered that curl could accidentally leak authentication data.
An attacker could possibly use this to get access to sensitive information.
(CVE-2018-1000007)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: HTTP authentication leak in redirects
vendor_redhat·2018-01-24·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CWE-200 curl: HTTP authentication leak in redirects
curl: HTTP authentication leak in redirects
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
It was found that curl and libcurl might send their Authentication header to a third party HTTP s
Debian
CVE-2018-1000007: curl - libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third ...
vendor_debian·2018·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007: curl - libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third ...
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
Scope: local
bookworm: resolved (fixed in 7.58.0-1)
bullseye: resolved (fixed in 7.58.0-1)
forky: resolved (fixed in 7.58.0-1)
sid: resolved (f
No detection rules found.
No public exploits indexed.
HackerOne
Alt-Svc bypasses credential leak protection (CVE-2018-1000007)
hackerone·2026-01-04·CVSS 9.8
CVE-2018-1000007 [CRITICAL] Alt-Svc bypasses credential leak protection (CVE-2018-1000007)
Alt-Svc bypasses credential leak protection (CVE-2018-1000007)
## Summary
I found a bug where curl's Alt-Svc implementation fails to strip sensitive authentication headers (Authorization and Cookies) when remapping a connection to a different host or port. This essentially bypasses the security fix for CVE-2018-1000007.
While auditing the code, I noticed that Alt-Svc remappings in `lib/url.c` update `conn->conn_to_host.name` and `conn->conn_to_port`, but the authentication guard in `lib/vauth/vauth.c` (the `Curl_auth_allowed_to_host` function) only checks the original `conn->host.name` and `conn->remote_port`.
Additionally, Alt-Svc remappings do not set the `data->state.this_is_a_follow` flag. Since the auth guard only activates when this flag is TRUE, the entire credential protection l
HackerOne
CVE-2022-27776: Auth/cookie leak on redirect
hackerone·2022-04-29·CVSS 5.7
CVE-2022-27776 [MEDIUM] CVE-2022-27776: Auth/cookie leak on redirect
CVE-2022-27776: Auth/cookie leak on redirect
## Summary:
curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side (for example by redirecting to a non-privileged port such as 9999 on the same host).
## Steps To Reproduce:
1. Configure for example Apache2 to perform redirect with mod_rewrite:
```
RewriteCond %{HTTP_USER_AGENT} "^curl/"
RewriteRule ^/redirectpoc http://hostname.tld:9999 [R=301,L]
```
... the attacker could also use `.htpasswd` file to do so.
2. Set up netcat to listen for the incoming secrets:
`while true; do echo -ne 'HTTP/1.1 404 nope\r\nContent-Length: 0\r\n\r\n' |
HackerOne
Proxy-Authorization header carried to a new host on a redirect
hackerone·2021-03-08·CVSS 9.8
[CRITICAL] Proxy-Authorization header carried to a new host on a redirect
Proxy-Authorization header carried to a new host on a redirect
hi cURL team
I am not entirely sure this is an issue, please feel free to close of it isn't.
I noticed that when making an HTTP GET request with Proxy-Authorization header, together with the "-L" flag to follow redirects
curl -H "Authorization-Proxy: Basic xxx==" http://host:8000 -L
If the remote web server redirects to an alternate host/port, cURL will carry over the Proxy-Authorization header to the redirected new host along with the secret.
If Authorization header is used (vs Proxy-Authentication) then the header gets stripped as it should.
Client sends GET request with Proxy-Authorization header to Server 1:8080
Server1 Redirects cURL to Server2:8081
Server2:8081 Receives the Proxy-Authorization header
This was repro
Bugzilla
CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host
bugzilla·2019-09-27·CVSS 9.8
CVE-2019-15052 [CRITICAL] CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host
CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
References:
https://github.com/gradle/gradle/issues/10278
https://github.com/gradle/gradle/pull/10176
https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
Discussion:
Created gradle tracking bugs for this issue:
Affects: epel-6 [bug 1756390]
Affects: fedora-all [bug 1756389]
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://ac
Bugzilla
wget: HTTP authentication leak in redirects
bugzilla·2019-09-11·CVSS 9.8
CVE-2018-1000007 [CRITICAL] wget: HTTP authentication leak in redirects
wget: HTTP authentication leak in redirects
wget is affected by a behavior similar to CVE-2018-1000007 (curl) : when given a `Authorization` header, wget will reuse it by default on the 2nd server if the first replies with a 3xx redirect.
This possibly mean a leak of credentials to the 2nd server.
Note: this does not happen when username/password are provided using the regular options (e.g.: --user & --password)
Discussion:
Acknowledgments:
Name: Ryan Blakley
---
Per upstream bug report, https://savannah.gnu.org/bugs/?56909, no change is currently planned in wget.
Bugzilla
CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [epel-7]
bugzilla·2018-01-24·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [epel-7]
CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the '
Bugzilla
CVE-2018-1000007 curl: HTTP authentication leak in redirects [fedora-all]
bugzilla·2018-01-24·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007 curl: HTTP authentication leak in redirects [fedora-all]
CVE-2018-1000007 curl: HTTP authentication leak in redirects [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [fedora-all]
bugzilla·2018-01-24·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [fedora-all]
CVE-2018-1000007 mingw-curl: curl: HTTP authentication leak in redirects [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2018-1000007 curl: HTTP authentication leak in redirects
bugzilla·2018-01-22·CVSS 9.8
CVE-2018-1000007 [CRITICAL] CVE-2018-1000007 curl: HTTP authentication leak in redirects
CVE-2018-1000007 curl: HTTP authentication leak in redirects
It was found that libcurl might accidentally leak authentication data to third parties.
When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value.
Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
This bug has existed since before curl 6.0.
Discussion:
Acknowledgments:
Nam
http://www.openwall.com/lists/oss-security/2022/04/27/4http://www.securitytracker.com/id/1040274https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3157https://access.redhat.com/errata/RHSA-2018:3558https://access.redhat.com/errata/RHSA-2019:1543https://access.redhat.com/errata/RHSA-2020:0544https://access.redhat.com/errata/RHSA-2020:0594https://curl.haxx.se/docs/adv_2018-b3bf.htmlhttps://lists.debian.org/debian-lts-announce/2018/01/msg00038.htmlhttps://usn.ubuntu.com/3554-1/https://usn.ubuntu.com/3554-2/https://www.debian.org/security/2018/dsa-4098https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://www.openwall.com/lists/oss-security/2022/04/27/4http://www.securitytracker.com/id/1040274https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3157https://access.redhat.com/errata/RHSA-2018:3558https://access.redhat.com/errata/RHSA-2019:1543https://access.redhat.com/errata/RHSA-2020:0544https://access.redhat.com/errata/RHSA-2020:0594https://curl.haxx.se/docs/adv_2018-b3bf.htmlhttps://lists.debian.org/debian-lts-announce/2018/01/msg00038.htmlhttps://usn.ubuntu.com/3554-1/https://usn.ubuntu.com/3554-2/https://www.debian.org/security/2018/dsa-4098https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2018-01-24
Published