PT-2023-23001 · Unknown · Typed-Rest-Client

Jlleitschuh

·

Published

2023-04-26

·

Updated

2023-06-01

·

CVE-2023-30846

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions typed-rest-client versions 1.7.3 and earlier
Description The typed-rest-client library is vulnerable to leaking authentication data to third parties. This occurs when a request is sent with BasicCredentialHandler, BearerCredentialHandler, or PersonalAccessTokenCredentialHandler, and the target host returns a redirection with a link to a second host. The next request will then use the credentials to authenticate with the second host by setting the Authorization header, which is not the expected behavior. The problem was fixed in version 1.8.0.
Recommendations For typed-rest-client versions 1.7.3 and earlier, update to version 1.8.0 to resolve the issue. As a temporary workaround, consider disabling the use of BasicCredentialHandler, BearerCredentialHandler, and PersonalAccessTokenCredentialHandler until the update is applied. Restrict access to sensitive resources that may be exposed due to this vulnerability.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-30846
GHSA-558P-M34M-VPMQ

Affected Products

Typed-Rest-Client