Security: Authorization/Cookie headers leaked on cross-origin redirects (GHSA-396q-4vc8-28x9)

[gavinbarron]

Summary

A security vulnerability exists in @microsoft/kiota-http-fetchlibrary versions >= 1.0.0-preview.97 through 1.0.0-preview.101 (advisory GHSA-396q-4vc8-28x9).

The RedirectHandler's defaultScrubSensitiveHeaders callback uses case-sensitive property deletion (delete headers.Authorization, delete headers.Cookie) on a headers object whose keys have already been lower-cased by FetchRequestAdapter.getRequestFromRequestInformation. This means the scrub is a no-op and any Bearer token or Cookie is forwarded to attacker-controlled hosts across a 30x redirect.

Impact

• Bearer token leak across origin on cross-origin redirects
• Session cookie leak across origin on cross-origin redirects
• Affects the default middleware chain with no custom configuration required
• Applies to every kiota-generated TypeScript SDK using BaseBearerTokenAuthenticationProvider

Affected dependency in this repo

This repo depends on @microsoft/kiota-bundle@^1.0.0-preview.82 which transitively pulls in the vulnerable @microsoft/kiota-http-fetchlibrary.

Resolution

Update @microsoft/kiota-bundle to ^1.0.0-preview.102 which includes the patched @microsoft/kiota-http-fetchlibrary@1.0.0-preview.102.

References

• GHSA-396q-4vc8-28x9