Listen to this Post
The dio_http2_adapter package for Dart is susceptible to a sensitive information disclosure vulnerability when following HTTP Location redirects. By default, the adapter’s internal fetch mechanism automatically follows up to a configured number of redirects (typically up to five) and unconditionally preserves and forwards all original request headers, including sensitive credentials like Authorization, Cookie, and Proxy-Authorization. When an origin server returns a cross-origin 302 redirect pointing to a different domain or malicious endpoint, the full set of original sensitive request headers is emitted verbatim to the new authority without any origin comparison or sanitization. Because followRedirects is enabled by default and no authentication is required to initiate the request, an attacker controlling or compromising an intermediate HTTP server can capture bearer tokens, session identifiers, or proxy credentials simply by issuing a cross-origin redirect response. This compromises user confidentiality across server-side Dart applications, Flutter mobile/desktop clients, and CLI tools utilizing the HTTP/2 adapter.
DailyCVE Form:
Platform: Dart Flutter
Version: <= 5.x
Vulnerability : Information Disclosure
Severity: High
date: 2024-XX-XX
Prediction: 2024-11-XX
What Undercode Say:
The vulnerability stems from how options.copyWith() is invoked during redirect handling inside plugins/http2_adapter/lib/src/http2_adapter.dart without overriding or clearing headers.
To inspect headers and network traffic during debugging or analysis, use standard curl or bash commands:
curl -i -H "Authorization: Bearer TOKEN" http://127.0.0.1:18081/start
Exploit: (Educational Purposes!)
The proof of concept can be executed inside an isolated container environment using Docker to demonstrate credential leakage:
docker build -f vuln-001/Dockerfile -t dio-vuln-001:poc . docker run --rm --network none dio-vuln-001:poc
Protection: from this CVE
Upgrade dio_http2_adapter to a patched version that checks if redirect targets are same-origin before propagating sensitive headers, or explicitly strip Authorization, Cookie, and Proxy-Authorization headers upon cross-origin redirects.
Impact:
Attackers can intercept sensitive user credentials, bearer tokens, and session cookies via malicious or compromised cross-origin 302 redirects, leading to unauthorized account impersonation and full session takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
