CVE-2020-11021: 
JavaScript vulnerability analysis and mitigation

The CVE-2020-11021 vulnerability affects Http-Client (NPM @actions/http-client) versions before 1.0.8. The vulnerability allows the disclosure of Authorization headers to incorrect domains in specific redirect scenarios. This security issue was discovered and disclosed in April 2020 (GitHub Advisory).

The vulnerability occurs under specific conditions when users of the http-client make an HTTP request with an authorization header that leads to a redirect (302) to another domain or hostname. In such cases, the authorization header is incorrectly passed to the other domain, potentially exposing sensitive authentication information. The issue was addressed in version 1.0.8 by implementing header stripping functionality when redirects occur to different hostnames (GitHub Advisory).

The primary impact of this vulnerability is the potential exposure of authorization headers to unauthorized domains during redirect scenarios. This could lead to the disclosure of sensitive authentication tokens, including GITHUB_TOKEN in GitHub Actions environments. While the GITHUB_TOKEN is scoped per job with specific permissions, the exposure of such credentials could still pose security risks (GitHub Advisory).

The vulnerability can be exploited when three specific conditions are met: the HTTP request contains an authorization header, the request results in a 302 redirect, and the redirect points to a different domain or hostname. No active exploits in the wild have been publicly reported (GitHub Advisory).

The vulnerability was patched in version 1.0.8 of the Http-Client package. The fix involves stripping the authorization header before making redirected requests when the hostname differs from the original request. Users are strongly advised to upgrade to version 1.0.8 or later, as no alternative workarounds are available (GitHub Advisory).