Information Disclosure in Microsoft Kiota HTTP Fetch Library

Executive Summary

The vulnerability exists in the @microsoft/kiota-http-fetchlibrary package versions 1.0.0-preview.97 through 1.0.0-preview.101. The RedirectHandler is intended to strip Authorization and Cookie headers from cross-origin redirect targets to prevent sensitive data leakage. However, the default scrubSensitiveHeaders callback deletes these headers using case-sensitive keys on a headers object that has already been lower-cased. As a result, the deletion does not occur, and sensitive headers like Bearer tokens or Cookies are forwarded to attacker-controlled hosts during 30x redirects.

This issue affects every kiota-generated TypeScript SDK that uses BaseBearerTokenAuthenticationProvider or any authentication provider setting the Authorization header. The vulnerability can be exploited by an attacker controlling a redirect target, causing leakage of sensitive authentication data.

The fix, introduced in version 1.0.0-preview.102, modifies the scrubSensitiveHeaders function to remove sensitive headers case-insensitively by iterating over all header keys and deleting those matching Authorization, Cookie, or Proxy-Authorization regardless of case.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unintended leakage of sensitive authentication information such as Bearer tokens and session Cookies to attacker-controlled hosts during HTTP redirects.

An attacker who controls a redirect target or can influence redirect URLs can exploit this flaw to capture authentication credentials, potentially gaining unauthorized access to user accounts or sensitive data.

Because the issue occurs in the default middleware chain without any custom configuration, all applications using affected versions of the kiota-generated TypeScript SDKs with authentication headers are at risk.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring HTTP requests and redirects to identify if Authorization or Cookie headers are being forwarded to cross-origin redirect targets.

You can inspect network traffic or logs for 30x HTTP redirects where sensitive headers like Authorization or Cookie are present in requests to different origins.

Commands to help detect this include using tools like curl or tcpdump to capture and analyze HTTP headers during redirects.

• Using curl with verbose output to follow redirects and show headers: curl -v -L <URL>
• Using tcpdump to capture HTTP traffic on port 80 or 443: tcpdump -i <interface> -A 'tcp port 80 or tcp port 443'
• Using browser developer tools to monitor network requests and check if Authorization or Cookie headers are sent to unexpected domains during redirects.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the @microsoft/kiota-http-fetchlibrary package to version 1.0.0-preview.102 or later, where the vulnerability is patched.

The patch modifies the header scrubbing logic to case-insensitively remove Authorization, Cookie, and Proxy-Authorization headers on cross-origin redirects, preventing sensitive data leakage.

If upgrading immediately is not possible, consider implementing custom middleware or configuration to ensure sensitive headers are properly removed during redirects.

Additionally, review and restrict redirect targets to trusted domains to reduce the risk of leaking tokens or cookies to attacker-controlled hosts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes Bearer tokens and session cookies to be leaked to attacker-controlled hosts during cross-origin HTTP redirects due to improper case-sensitive header removal.

Such leakage of sensitive authentication information can lead to unauthorized access to user data or sessions, which may result in violations of data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

Therefore, this vulnerability can negatively impact compliance with these standards by exposing sensitive authentication credentials to unauthorized parties.

Useful 0 Not Useful 0