Insertion of Sensitive Information Into Sent Data Affecting mechanize package, versions <2.14.1

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the request_add_headers function in Mechanize::HTTP::Agent. An attacker who controls a redirect target can capture caller-supplied Authorization, Cookie, Proxy-Authorization, and Cookie2 headers by causing a request to redirect to that host; credentials can also be resent on later requests or retries during the same operation, exposing tokens and cookie values. The exposure concerns caller-set headers, including custom credential headers; credentials from AuthStore and cookies from cookie_jar are unaffected.

Notes

• At the header-sending step, the leak is limited to credentials supplied as request headers; cookies in Mechanize#cookie_jar and credentials in Mechanize::HTTP::AuthStore are looked up per URI and do not follow the redirect.

Workarounds

• Set Mechanize#redirect_ok = false and handle redirects explicitly; this prevents Mechanize from automatically sending caller-supplied credential headers to a redirect target.
• Avoid setting credentials with request_headers=; pass them per request only when you intend to authenticate to that host, limiting which requests carry the credentials.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory