GHSA-q6gh-6v2r-hjv3: Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers
DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected: DefaultHttpClient.java lines 231-245, 1591, 2071
Suggested fix: Strip sensitive headers on cross-domain redirects
References
- github.com/advisories/GHSA-q6gh-6v2r-hjv3
- github.com/micronaut-projects/micronaut-core/commit/64e539736b8168f201d868b02ace50fe14f57418
- github.com/micronaut-projects/micronaut-core/commit/70cab4b44fbf985faba2846091f2356b5bd70719
- github.com/micronaut-projects/micronaut-core/commit/9770328999f490bdfbb9e25addd45bf73d4a173a
- github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-q6gh-6v2r-hjv3
Code Behaviors & Features
Detect and mitigate GHSA-q6gh-6v2r-hjv3 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →