CVE-2024-28849: 
JavaScript vulnerability analysis and mitigation

The follow-redirects package, an open source drop-in replacement for Node's http and https modules that automatically follows redirects, contains a vulnerability (CVE-2024-28849) where it only clears the authorization header during cross-domain redirects but retains the proxy-authentication header which also contains credentials. This vulnerability was discovered in versions prior to 1.15.6 and was disclosed on March 14, 2024 (GitHub Advisory).

The vulnerability stems from incomplete header sanitization during cross-domain redirects. While the package correctly removes the authorization and cookie headers when redirecting across domains, it fails to clear the proxy-authentication header, which may contain sensitive credentials. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, and high impact on confidentiality (GitHub Advisory).

The vulnerability could lead to credential leakage when requests are redirected across different domains. If an attacker can control the redirect destination, they could potentially capture sensitive proxy authentication credentials that should have been stripped from the redirected request (GitHub Advisory).

The vulnerability can be exploited in scenarios where an application using follow-redirects (either directly or through dependencies like axios) makes requests with proxy authentication headers and encounters cross-domain redirects. A proof of concept demonstrates that when making a request with both Authorization and Proxy-Authorization headers, only the Authorization header is cleared during cross-domain redirects while the Proxy-Authorization header remains (GitHub Advisory).

The vulnerability has been fixed in version 1.15.6 of follow-redirects. The fix involves modifying the header removal regex to include proxy-authorization headers during cross-domain redirects. Users are advised to upgrade to version 1.15.6 or later. There are no known workarounds for this vulnerability (GitHub Advisory).

The vulnerability has led to security updates in various dependent packages and distributions. Red Hat has issued multiple security advisories for affected products including OpenShift GitOps and OpenShift Service Mesh (Red Hat Advisory, Red Hat Advisory). Fedora has also released security updates to address this vulnerability in affected packages (Fedora Update).