CVE-2023-30846
📋 TL;DR
This vulnerability in typed-rest-client allows authentication credentials (basic auth, bearer tokens, or personal access tokens) to be unintentionally sent to third-party servers during HTTP redirects. Users of typed-rest-client version 1.7.3 or lower who make authenticated requests that encounter redirects are affected.
💻 Affected Systems
- typed-rest-client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authentication tokens are sent to malicious third-party servers, leading to account compromise, data breaches, and unauthorized access to protected resources.
Likely Case
Credentials are inadvertently sent to legitimate but unintended third-party services during normal redirect flows, potentially exposing sensitive authentication data.
If Mitigated
With proper network segmentation and monitoring, credential exposure can be detected and contained before significant damage occurs.
🎯 Exploit Status
Exploitation requires the attacker to control a server that receives redirects from the target application, making it dependent on specific application flows.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.0
Vendor Advisory: https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq
Restart Required: No
Instructions:
1. Update typed-rest-client to version 1.8.0 or higher. 2. Run 'npm update typed-rest-client' or 'yarn upgrade typed-rest-client'. 3. Test application functionality after update.
🔧 Temporary Workarounds
No known workarounds
allThe advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Monitor network traffic for unexpected Authorization headers sent to third-party domains
- Implement strict outbound firewall rules to limit which external domains your application can communicate with
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list typed-rest-client' to see if version is 1.7.3 or lower.Check Version:
npm list typed-rest-client | grep typed-rest-clientVerify Fix Applied:
Verify typed-rest-client version is 1.8.0 or higher using 'npm list typed-rest-client'.📡 Detection & Monitoring
Log Indicators:
- Unexpected HTTP redirects to external domains in application logs
- Failed authentication attempts from unexpected IPs or domains
Network Indicators:
- Authorization headers sent to domains different from the original request target
- HTTP 3xx responses followed by authenticated requests to new domains
SIEM Query:
http.status_code:3* AND http.request.headers.authorization EXISTS🔗 References
- https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8
- https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq
- https://security.netapp.com/advisory/ntap-20230601-0008/
- https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8
- https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq
- https://security.netapp.com/advisory/ntap-20230601-0008/
