Threats Tagged 'ghsa-f45q-w629-wr25'

The Hubuum client library for Rust versions from 0.0.1 up to but not including 0.6.1 has a vulnerability where authenticated requests may leak the bearer Authorization header outside the configured base path due to how HTTP redirects are handled. The library uses reqwest's default redirect policy, which retains sensitive headers on redirects within the same origin but different paths. An attacker or compromised intermediary influencing a 3xx redirect response could cause the Authorization header to be sent to unintended paths on the same origin. This does not affect cross-origin redirects. The issue is fixed in version 0.6.1 by disabling automatic redirect following. Workarounds include configuring reqwest clients to disable redirects and ensuring the Hubuum origin is not shared with other applications that could redirect requests outside the allowed path prefix.