Information Exposure Affecting deno package, versions <2.1.2

deno is an a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.

Affected versions of this package are vulnerable to Information Exposure due to improper handling of HTTP headers during cross-origin redirects. An attacker can leak sensitive information such as authentication tokens by exploiting this behavior.

const ac = new AbortController()

const server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) => {
  return new Response(null, {
    status: 302,
    headers: {
      'location': 'http://localhost:3002/redirected'
    },
  })
})

const server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) => {
  const body = JSON.stringify({
    url: req.url,
    hasAuth: req.headers.has('authorization'),
  })
  return new Response(body, {
    status: 200,
    headers: {'content-type': 'application/json'},
  })
})

async function main() {
  const response = await fetch("http://localhost:3001/", {
    headers: {authorization: 'Bearer foo'}
  })
  const body = await response.json()
  
  ac.abort()
  
  if (body.hasAuth) {
    console.error('ERROR: Authorization header should not be present after cross-origin redirect')
  } else {
    console.log('SUCCESS: Authorization header is not present after cross-origin redirect')
  }
}

setTimeout(main, 500)

• GitHub Advisory