PT-2024-2572 · Unknown+3 · Follow-Redirects+3

4Xpl0R3R · Published 2024-03-14 · Updated 2026-04-28 · CVE-2024-28849

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions follow-redirects versions prior to 1.15.6

Description The issue is related to insufficient protection of sensitive data in the follow-redirects module, which is a drop-in replacement for Node's http and https modules. This module automatically follows redirects but only clears the authorization header during cross-domain redirects, keeping the proxy-authentication header that contains credentials. This may lead to credentials leak. There are no known workarounds for this issue.

Recommendations For versions prior to 1.15.6, upgrade to version 1.15.6 to address the issue. As a temporary workaround, consider removing the proxy-authentication header during cross-domain redirects.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

AZL-36895

AZL-43861

AZL-44493

BDU:2024-02610

CVE-2024-28849

GHSA-CXJH-PQWP-8MFP

OPENSUSE-SU-2024:13830-1

RHSA-2024:3781

USN-8217-1

Affected Products

Debian

Linuxmint

Ubuntu

Follow-Redirects

References · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28849.json · Exploit
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp · Vendor Advisory
• https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28849 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0536 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8217-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28849 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26159 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28849 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28849 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13830-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxjh-pqwp-8mfp · Vendor Advisory
• https://osv.dev/vulnerability/AZL-36895 · Vendor Advisory