PT-2022-3647 · Lquixada · Cross-Fetch
Published
2022-01-06
·
Updated
2022-11-22
·
CVE-2022-1365
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
lquixada/cross-fetch versions prior to 3.1.5
Description
The issue is related to the exposure of private personal information to an unauthorized actor. It is associated with errors in handling files, specifically cookies, in the WHATWG Fetch API for Node Cross-fetch. This can allow a remote attacker to gain unauthorized access to protected information. When fetching a remote URL with a cookie, if a Location response header is received, the request will follow that URL and attempt to fetch it with the provided cookie, potentially leaking the cookie to a third party.
Recommendations
For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of cookies in the affected API endpoint until a patch is available. Avoid using the
Cookie header in requests to minimize the risk of exploitation.Exploit
Fix
Incorrect Authorization
Improper Access Control
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cross-Fetch