CVE-2023-45289 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
A malicious HTTP redirect can cause sensitive headers like Authorization or Cookies to be unexpectedly forwarded to a different domain, leaking credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45289?
CVE-2023-45289 is a medium-severity vulnerability in Go standard library net/http, published on 5 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
Which versions are affected by CVE-2023-45289?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.21.8, 1.22.1 |
stdlib Go | All versions | 1.21.8, 1.22.1 |
How do I fix CVE-2023-45289?
Upgrade golang to a fixed version for your release line: 1.21.8 or 1.22.1.
Is CVE-2023-45289 being exploited?
There is no known exploitation of CVE-2023-45289 in the wild and no public exploit code.
Sources
Also known as AZL-37462, AZL-37473, AZL-78974, AZL-98628, BELL-CVE-2023-45289, BIT-golang-2023-45289 and 7 more.