- Description
- In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target.
As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge.
An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.
- Source
- emo@eclipse.org
- NVD status
- Analyzed
- Products
- vert.x
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8D44E871-B846-46B4-A134-81D5CCD160BD",
"versionEndIncluding": "4.5.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"matchCriteriaId": "20CCD041-C4F7-4580-ABF9-91EF0C16E7F1",
"versionEndIncluding": "5.1.4",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]