CVE-2023-30846 typed-rest-client vulnerable to potential leak of authentication data to 3rd parties
Attackers can steal authentication credentials when the library follows redirects to third-party hosts, exposing sensitive data to unauthorized parties.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30846?
CVE-2023-30846 is a critical vulnerability in microsoft typed-rest-client, published on 26 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.
Weakness: CWE-522
Which versions are affected by CVE-2023-30846?
2 open source packages ship an affected version, including typed-rest-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
typed-rest-client npm | All versions | 1.8.0 |
typed-rest-client npm | All versions | 1.8.0 |
Products include Microsoft Typed-Rest-Client.
How do I fix CVE-2023-30846?
Upgrade typed-rest-client to 1.8.0 or later.
Is CVE-2023-30846 being exploited?
There is no known exploitation of CVE-2023-30846 in the wild and no public exploit code.
Sources
Also known as GHSA-558p-m34m-vpmq.