Listen to this Post
How the CVE Works:
Reactor Netty HTTP clients (versions >=1.3.0-M1, <1.3.0-M5 and <1.2.8) fail to strip authentication headers during chained HTTP redirects. When configured to follow redirects, the client inadvertently forwards credentials to subsequent endpoints, exposing them to unintended servers. This occurs due to improper header sanitization during redirect handling, violating RFC 7231 security requirements.
DailyCVE Form:
Platform: Reactor Netty
Version: <1.2.8, 1.3.0-M1–M4
Vulnerability: Credential leak
Severity: Moderate
Date: 2025-07-16
Prediction: Patch expected by 2025-08-15
What Undercode Say:
Check vulnerable versions: npm view reactor-netty versions | grep "1.2.[0-7]|1.3.0-M[1-4]" Exploit PoC (simulated): curl -H "Authorization: Bearer <token>" http://redirect-chain.example.com Mitigation test: netty-http-client --disable-redirects
How Exploit:
Attackers craft malicious redirect chains (3xx responses) to intercept credentials. No user interaction required—exploited via server-side request forgery (SSRF) or phishing.
Protection from this CVE:
1. Upgrade to v1.2.8/1.3.0-M5.
2. Disable redirects: `HttpClient.followRedirect(false)`.
3. Manual header stripping pre-redirect.
Impact:
Confidentiality breach—exposed API keys, session tokens. High risk in microservices architectures.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
