Lightrun
question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Headers are forwarded when the URL redirects to another domain and should not be (information leak)

See original GitHub issue

Hey there!

I belong to an open source security research community, and a member (@sampaguitas) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:10 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
FGRibreaucommented, Feb 21, 2022

Fixed and released in v7.0.0 (since it might break things for some people)

1reaction
Sampaguitascommented, Feb 15, 2022

Hi @FGRibreau, @JamieSlome,

The PR has been submitted :

https://github.com/fgribreau/node-request-retry/compare/HEAD...sampaguitas:master

I would appreciate if you could validate the finding & fix on hunter.dev:

https://huntr.dev/bounties/a779faf5-c2cc-48be-a31d-4ddfac357afc/

Have a nice day,

Timothee

Read more comments on GitHub >

github_iconTop Results From Across the Web

Unvalidated Redirects and Forwards Cheat Sheet
Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request...
Read more >
URL Redirection - Attack and Defense - Virtue Security
URL Redirection is a straight forward vulnerability which can manifest in complex ways. We will look at three basic types of open redirects...
Read more >
Open Redirect Vulnerabilities and How to Avoid Them - Invicti
Open redirect vulnerabilities occur when attackers are able to trick a vulnerable website into redirecting the user to a malicious site.
Read more >
How to identify and exploit HTTP Host header vulnerabilities
You can also uncover quirky behavior by indenting HTTP headers with a space character. Some servers will interpret the indented header as a...
Read more >
Redirections in HTTP - MDN Web Docs - Mozilla
URL redirection, also known as URL forwarding, is a technique to give more than one URL address to a page, a form, or...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found
Previous page

issues met when debugging an x86_64 emulation process at the arm64 instruction-level

Next page

Some errors are retried until max but then returned as successful