Skip to content
Log inStart free trial

GHSA-558p-m34m-vpmq CVE-2023-30846

Potential leak of authentication data to 3rd parties

High npm
Severity
9.1 / 10
High · CVSS 3.1
Exploit chance (EPSS)
2.22%
Chance of exploitation in the next 30 days. Higher than 82.71% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-522 Insufficiently Protected Credentials
Fix
1.8.0
Upgrade typed-rest-client to this version or later

Description

Impact

Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.

The flow of the vulnerability is as follows:

  1. Send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler
  2. The target host may return a redirection (3xx), with a link to a second host.
  3. The next request will use the credentials to authenticate with the second host, by setting the Authorization header.

The expected behavior is that the next request will NOT set the Authorization header.

Patches

The problem was fixed on April 1st 2020.

Workarounds

There is no workaround.

References

This is similar to the following issues in nature:

  1. HTTP authentication leak in redirects - I used the same solution as CURL did.
  2. CVE-2018-1000007.

Affected versions

npm

PackageVulnerableFixed in
typed-rest-client
< 1.8.0
1.8.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

typed-rest-client npm → 1.8.0

npm
npm install typed-rest-client@1.8.0
yarn
yarn add typed-rest-client@1.8.0
pnpm
pnpm add typed-rest-client@1.8.0

Severity breakdown

CVSS 3.1 9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-522: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it
  • Architecture and Design: Use an appropriate security mechanism to protect the credentials.
  • Architecture and Design: Make appropriate use of cryptography to protect the credentials.
  • Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-113440
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Not rated yet Same weakness, CWE-522
GHSA-3wp9-xfwm-rjjf
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Medium Same weakness, CWE-522
GHSA-jmqq-x5g9-9p2w
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Critical Same weakness, CWE-522
GHSA-rqf5-2wxv-rjf4
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
High Same weakness, CWE-522
GHSA-xr57-gcx8-52hf
AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
Medium Same weakness, CWE-522
GHSA-f8m2-889x-vw4x
AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target
Medium Same weakness, CWE-522
GHSA-88f6-4rjv-x774
Vikunja: TOTP secret is readable after enrollment, no step-up auth
Medium Same weakness, CWE-522
GHSA-486v-q2wf-fp2r
rclone: http backend forwards custom/auth headers to a different host on redirect
Medium Same weakness, CWE-522
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor