CVE-2023-45289
MediumSummary
A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.
Risk Assessment
The risk involves potential leakage of sensitive authentication data (tokens, cookies) during cross-domain redirects, which could allow an attacker to hijack sessions or gain unauthorized access.
Recommendation
It is recommended to upgrade to Go version 1.21.6 or 1.22.0, which include the fix. Also review application code for manual header handling during redirects.
Original NVD description (English source)
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a red