GHSA-f27p-cmv8-xhm6
Vulnerability from github
Summary
When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.
Details
The right behavior would be to drop the Authorization header instead, in this scenario. The same is generally applied to Cookie and Proxy-Authorization headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as "origin".
The documentation states:
Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno does not need to protect against leaking authenticated data cross origin
Reproduction
```ts const ac = new AbortController()
const server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) => { return new Response(null, { status: 302, headers: { 'location': 'http://localhost:3002/redirected' }, }) })
const server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) => { const body = JSON.stringify({ url: req.url, hasAuth: req.headers.has('authorization'), }) return new Response(body, { status: 200, headers: {'content-type': 'application/json'}, }) })
async function main() { const response = await fetch("http://localhost:3001/", { headers: {authorization: 'Bearer foo'} }) const body = await response.json()
ac.abort()
if (body.hasAuth) { console.error('ERROR: Authorization header should not be present after cross-origin redirect') } else { console.log('SUCCESS: Authorization header is not present after cross-origin redirect') } }
setTimeout(main, 500) ```
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "deno_fetch"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.1"
},
{
"fixed": "0.204.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.46.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-21620"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-06T22:27:09Z",
"nvd_published_at": "2025-01-06T23:15:07Z",
"severity": "HIGH"
},
"details": "### Summary\nWhen you send a request with the `Authorization` header to one domain, and the response asks to redirect to a different domain, Deno\u0027s`fetch()` redirect handling creates a follow-up redirect request that keeps the original `Authorization` header, leaking its content to that second domain.\n\n\n### Details\n\nThe [right behavior](https://fetch.spec.whatwg.org/#ref-for-cors-non-wildcard-request-header-name) would be to drop the `Authorization` header instead, in this scenario. The same is generally applied to `Cookie` and `Proxy-Authorization` headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as \"origin\".\n\nThe [documentation](https://docs.deno.com/runtime/reference/web_platform_apis/#:~:text=Deno%20does%20not%20follow%20the,leaking%20authenticated%20data%20cross%20origin.) states: \n\u003e Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno **does not need** to protect against leaking authenticated data cross origin \n\n### Reproduction\n```ts\nconst ac = new AbortController()\n\nconst server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) =\u003e {\n return new Response(null, {\n status: 302,\n headers: {\n \u0027location\u0027: \u0027http://localhost:3002/redirected\u0027\n },\n })\n})\n\nconst server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) =\u003e {\n const body = JSON.stringify({\n url: req.url,\n hasAuth: req.headers.has(\u0027authorization\u0027),\n })\n return new Response(body, {\n status: 200,\n headers: {\u0027content-type\u0027: \u0027application/json\u0027},\n })\n})\n\nasync function main() {\n const response = await fetch(\"http://localhost:3001/\", {\n headers: {authorization: \u0027Bearer foo\u0027}\n })\n const body = await response.json()\n \n ac.abort()\n \n if (body.hasAuth) {\n console.error(\u0027ERROR: Authorization header should not be present after cross-origin redirect\u0027)\n } else {\n console.log(\u0027SUCCESS: Authorization header is not present after cross-origin redirect\u0027)\n }\n}\n\nsetTimeout(main, 500)\n```\n",
"id": "GHSA-f27p-cmv8-xhm6",
"modified": "2025-01-07T02:52:55Z",
"published": "2025-01-06T22:27:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21620"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "fetch: Authorization headers not dropped when redirecting cross-origin"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.